Penetration Tester

Requirements

• Must possess a bachelor's degree in IT or a related field (must indicate GPA in CV).
• Must have relevant certifications (e.g. OSCP, CREST, CRT).
• At least 2 years’ experience in penetration testing or a similar role in cybersecurity.
• Strong understanding of network protocols, application security, and operating systems.
• Proficiency with penetration testing tools (e.g., Metasploit, Burp Suite, Nmap, Kali Linux, Tenable, Metasploit).
• Experience with scripting languages (Python, Bash, etc.) and security frameworks.
• Experience in conducting penetration tests and vulnerability assessments on web & mobile applications, servers, networks, and database devices. Experience with wireless and mobile testing is also an advantage.
• Experience in testing both Windows and Linux environments.
• Ability to write solid, high-quality penetration testing reports.
• Proficient in Microsoft Office applications, including Word, Excel, Outlook, PowerPoint, etc.
• Strong communication skills in oral and written English.
• Highly organized, self-motivated, a fast learner, with good time management, enthusiastic, and able to work under minimal supervision.
• Pleasant personality and able to work as a team player.
• Possess a four-wheeled vehicle.
• Candidate must be Malaysian

Responsibilities

• Plan, scope, and execute penetration tests (black/grey/white box) against systems, networks, web and mobile applications, APIs, cloud services, and internal infrastructure.
• Develop and run exploit chains, proof-of-concept code, and realistic attack scenarios to validate impact.
• Perform vulnerability discovery using automated scanners and thorough manual testing (SAST/DAST, network scanning, fuzzing, logic flaws).
• Produce professional, prioritized penetration test reports: executive summary, technical findings, risk rating, and remediation steps.
• Present findings to technical teams and leadership; provide remediation guidance and retest to confirm fixes.
• Maintain and extend internal exploit tooling, scripts, and test frameworks; contribute to knowledge base and playbooks.
• Stay current with threat actor techniques, CVEs, exploit frameworks (Metasploit, Cobalt Strike alternatives), and new offensive tools.