Cybersecurity Engineer (Penetration Testing)

About the job

We are hiring a hands-on Cybersecurity Engineer (Penetration Testing) for our Kuala Lumpur office, open to mid-level or senior candidates. Seniority does not change the job: you do the hands-on work yourself. You report to the CTO and find real weaknesses before attackers do. This is not a report-only, scanner-only or checkbox seat.

This is a new role, and you will be the first and only person in it when you join. You won't be working alone, though: you will use AI agents to help with recon, testing, evidence gathering, reporting and retests. We are building penetration testing and security validation from the ground up with the CTO, so you will set up how testing gets done here.

You are expected to work independently and drive penetration testing with the CTO's direction, not wait to be tasked ticket by ticket.

A real part of this role is speeding up recon, custom checks, evidence packing and retests with Claude Code and AI agents, while you stay accountable for method, scope and quality. Commercial scanners are fine when they earn the cost.

Full on-site, Monday–Friday at Sunway Tower, Jalan Ampang, Kuala Lumpur. No hybrid or remote.

Key responsibilities

Penetration testing & validation

• Plan and run hands-on tests on web apps, APIs, cloud, network, identity and endpoints within agreed scope

• Find exploitable issues, not only scanner noise, and prove impact with clear evidence

• Write practical findings and fixes owners can act on

• Retest fixes and track closure with the CTO and system owners

• Support purple-team and security validation work with the SOC when needed

• Help improve secure build practices (app, cloud, infra) from what testing shows

Automation & AI

• Use Claude Code (or comparable) and scripts to speed recon, custom checks, evidence and reporting, responsibly

• Prefer build-or-script before buy when a commercial scanner does not earn the cost

• Keep methods repeatable so tests stay consistent across releases

Skills & experience required

• At least 2 years of hands-on penetration testing, red team or security validation, not theory-only or scanner-only. We consider mid-level and senior candidates, and both roles are hands-on.

• Practical testing across web apps and at least some of API, cloud, network, identity and endpoints

• Uses AI tools daily in your work

• Can write clear findings with severity, impact and fix guidance

• Comfortable scripting (e.g. Python, Bash or PowerShell) for custom checks

• Working knowledge of OWASP, common CVEs and MITRE ATT&CK

• Experience testing cloud-hosted systems (AWS and Huawei Cloud preferred), Linux, Windows and modern web stacks

• Must hold at least two active (not expired) certifications from the lists below, with at least one from the Penetration Testing list; three or more strongly preferred: Penetration Testing

  • Certified Ethical Hacker (CEH)

  • CompTIA PenTest+

  • CREST Penetration Tester

  • Mile2 Certified Penetration Testing Engineer (CPTE)

  • MITRE ATT&CK penetration testing certification

  • Certified Cloud Penetration Tester (CCPT)

  • CREST Certified Red Team Specialist (CCRTS)

  • GIAC Penetration Tester (GPEN)

  • Offensive Security Certified Professional (OSCP)

  • Rocheston Certified Cybersecurity Engineer (RCCE)

  • Global ACE Certified Penetration Tester (CPT) General

  • CompTIA Security+

  • CompTIA SecurityX

  • GIAC Security Essentials (GSEC)

• Can operate with limited supervision in a lean SME team

• Aligned with the CTO; escalate real risk clearly; verify remediation stuck

• Willing to support urgent validation after serious incidents when needed

Nice to have

• Hands-on with Claude Code or similar AI engineering tools to speed real testing work, not chat-only

• Open to building your own security tools with Claude Code (willing to self-learn)

• Bug bounty, CTF or purple-team experience

• Testing in a lean team without a large commercial toolkit budget

• Light exposure to SOC and incident response work

About the company

ModeFair is an expanding tech venture that excels in GovTech. We provide a holistic suite of services, ranging from strategic counsel and conceptualisation to UI/UX design, custom-made development & integration, and routine IT management.

We aim to retain strong talent with a conducive working environment and competitive benefits. Our culture is fast-paced: everyone uses AI heavily in their daily work, delivery speed and efficiency matter, and we hold people accountable for how they use their time. We promote trust, responsibility, and open communication — and we expect high ownership.