About This Role
This penetration testing role focuses on real security research across various environments, including web, infrastructure, cloud, AI, and mobile. It involves understanding how systems work, challenging assumptions, and conducting in-depth security research rather than just running tools. You will report to a Team Lead and work with a small team of security researchers in an international, collaborative, and highly technical setting, handling complex problems independently and on client engagements.
Responsibilities
- Conduct penetration testing and security research across web applications, infrastructure and networks, cloud and Kubernetes environments, AI systems, mobile applications, and source code
- Take ownership of security reporting, including technical accuracy, root-cause analysis, and real-world business impact, using AI tools to accelerate drafting
- Present vulnerabilities, findings, and recommendations clearly to clients and their technical teams
- Build internal security tools, methodologies, automation, and agentic workflows that enable the team to work faster and go deeper
- Contribute to red team and adversary emulation engagements
- Independently investigate unfamiliar technologies, attack surfaces, and complex technical problems
Requirements
- 3+ years of hands-on experience in penetration testing and/or security research
- Deep expertise in at least two of the following areas:
- Web application penetration testing
- Infrastructure and network penetration testing, including Active Directory, with real fluency in Windows and Linux internals, the protocols underneath, and privilege escalation
- Manual source code review and vulnerability research
- OSCP or CREST CRT certification
- Currently based in Singapore with valid work authorization
- Strong research mindset, technical curiosity, and the ability to independently investigate unfamiliar technologies and attack surfaces
- Hands-on experience using AI tools to support security testing, research, automation, or tool development, with a strong interest in exploring new AI-driven security workflows
- Ability to work independently on deep technical problems and collaboratively on live client engagements
- Excellent written and verbal English communication skills
- Availability to work in a hybrid model in Singapore, including regular work at client sites
Nice to have:
- Existing CAT1 or CAT2A security clearance
- Proficiency in Python or Node.js
- CREST CCT APP or CCT INF, or Offensive Security certifications beyond OSCP, such as OSWE, OSEP, or OSED
- Security research publications, strong CTF performance, or a demonstrated bug bounty track record
