Information Technology Security Engineer

Phincon Pte Ltd; Kota Bandung; On-site; IDR 240,000,000 - 420,000,000; Full time

Job summary

Phincon Pte Ltd in Bandung, Indonesia seeks a security engineer to perform penetration testing and red teaming on internal applications, identifying critical vulnerabilities and delivering PoCs with business impact assessments.

The role requires familiarity with ISO 27001, CIS Controls, and secure SDLC practices, plus scripting skills in bash or Python. You will collaborate with multiple teams to strengthen security across infrastructure and applications.

Qualifications

• Bachelor’s degree or equivalent in a relevant IT field.
• Experience with security testing and red teaming.
• Familiar with CIS Controls, ISO 27001, OWASP, PTES, and NIST SP 800-115 frameworks.

Responsibilities

• Penetration Testing & Red Teaming on internal apps to identify vulnerabilities and provide PoCs detailing technical and business impacts.
• Dependency Analysis & Validation across 100+ dependencies using CVEs, GHSA, and CVSS to map third‑party component risks.
• False Positive Elimination via manual code reviews and exploit replication based on CVEs.
• Secure SDLC implementation with security reviews before production deployment.
• Reporting & cross‑divisional collaboration: write and present findings to technical teams and management in clear language.
• Security standards consultation based on CIS Controls, ISO 27001, OWASP, PTES, and NIST SP 800‑115.

Skills

Linux OS

Windows OS

Cloud security

Scripting (bash, Python)

ISO 27001 familiarity

Education

Bachelor’s Degree in Software Engineering / Computer Science / Information Technology

Job description

• Bachelor’s Degree in Software Engineering / Computer Science / Information Technology / equivalent or relevant work experience.
• Good at managing sensitive and confidential data, workstation devices, patching and upgrading systems, applications, services, and other infrastructure foundational components.
• Familiar with ISO27001
• Familiar with Linux and Windows OS
• Familiar with cloud security services such as AWS, Azure, and GCP
• Able to create some script, i.e., bash, python
• Having certification in cloud security area is a plus

Job Descriptions:

• Penetration Testing & Red Teaming: Conducted attack simulations and red teaming activities on internal applications to identify critical security vulnerabilities (e.g., SQLi, XSS, brute force, authorization flaws) and developed PoCs detailing technical and business impacts.
• Dependency Analysis & Validation: Identified and analyzed over 100 packages/dependencies per application using CVE databases, GHSA, and CVSS score metrics to map third‑party component risks.
• False Positive Elimination: Performed manual source code reviews and manual exploit replications based on CVEs to ensure vulnerabilities were true positives, optimizing mitigation priorities.
• Secure SDLC Implementation: Executed security reviews and rigorous testing for every feature addition or application change prior to production deployment.
• Reporting & Cross‑Divisional Collaboration: Authored detailed penetration testing reports (findings, risk levels, mitigations) and presented them to both technical teams and non‑technical management in clear, accessible language.
• Security Standards Consultation: Provided architecture and security governance compliance recommendations based on CIS Controls, ISO 27001, OWASP, PTES, and NIST SP 800‑115 frameworks.