Head of Red Team

Head of Red Team

Key Responsibilities

Delivery

• Lead and perform VAPT across Web, Mobile, API, Network & Cloud, plus Red Team engagements.

• Identify, validate & document vulnerabilities, every finding manually verified, zero false positives.

• Prepare dual-layer reports: executive summary and technical findings with PoCs, CVSS ratings & remediation guidance.

• Work with the Blue Team/SOC when an engagement calls for it, purple team exercises, detection validation, or supporting incident investigations.

• Collaborate with client technical teams on testing, remediation & retesting phase.

Team & Project Leadership

• Lead, mentor & review the work of the Red Team; set testing standards and QA every report before it reaches the client.

• Scope engagements: define rules of engagement, estimate mandays, and assign testers per project.

• Work with the Project Manager on project planning; provide effort estimates, flag technical risks, and align tester availability with delivery timelines.

• Serve as technical point of contact alongside the Project Manager in client meetings — pre-sales scoping, kick-offs, and findings presentations.

• Research CVEs, emerging threats & tooling; build the team’s internal methodology and playbooks.

Qualifications

• 4+ years hands-on offensive security experience (VAPT / Red Team), including 1+ years leading a pentest team.

• Bachelor’s degree in Computer Science, Information Security, or related field.

• OSCP is mandatory. OSEP, OSWE, OSCE, CRTO, or GPEN is a strong plus.

• Experience delivering VAPT or Red Teaming for banks or financial institutions is strongly preferred, familiarity with OJK IT security requirements, PCI DSS, and testing core banking, mobile banking & payment APIs.

• Working knowledge of OWASP Top 10/ASVS, NIST SP 800-115, PTES & MITRE ATT&CK.

• Proficiency in Burp Suite, Nmap, Nessus, Metasploit, Nuclei & Postman.

• Strong manual testing skills: IDOR/BOLA, SSRF, RCE, SQLi, auth bypass & business logic flaws.

• Able to estimate effort, scope engagements, and write client-ready reports in English and Bahasa Indonesia.