Information Technology Security Engineer

PHINCON; Kota Bandung; On-site; IDR 180,000,000 - 320,000,000; Full time

Job summary

PHINCON is seeking a security-focused professional to lead penetration testing and secure development efforts in Bandung. You will perform red-team simulations on internal apps, assess dependencies with CVE metrics, and craft actionable mitigation plans for management.

Ideal candidates have ISO27001 familiarity, Linux/Windows expertise, and scripting skills in Bash/Python, with cloud security experience across AWS/Azure/GCP. Cloud certs are a plus.

Qualifications

• Bachelor's degree or relevant work experience.
• Good at managing sensitive and confidential data and infrastructure.
• Familiar with ISO27001 standards.
• Proficient with Linux and Windows OS.
• Familiar with cloud security services (AWS/Azure/GCP).
• Able to create scripts in Bash or Python.
• Cloud security certification is a plus.

Responsibilities

• Penetration testing and red-teaming on internal applications to identify vulnerabilities and develop PoCs.
• Dependency analysis across applications using CVE databases and CVSS metrics.
• False positive elimination through manual reviews and exploit replication.
• Secure SDLC implementation with security reviews before production.
• Prepare detailed penetration testing reports and present to tech and management.
• Provide security governance recommendations based on CIS Controls, ISO 27001, OWASP, PTES, NIST.

Skills

Penetration testing

ISO27001 familiarity

Linux

Windows OS

Cloud security (AWS/Azure/GCP)

Scripting (bash/python)

Education

Bachelor's degree in Software Eng / CS / IT or equivalent

Job description

• Bachelor’s Degree in Software Engineering / Computer Science / Information Technology / equivalent or relevant work experience.
• Good at managing sensitive and confidential data, workstation devices, patching and upgrading systems, applications, services, and other infrastructure foundational components.
• Familiar with ISO27001
• Familiar with Linux and Windows OS
• Familiar with cloud security services such as AWS, Azure, and GCP
• Able to create some script, i.e., bash, python
• Having certification in cloud security area is a plus

Job Descriptions:

• Penetration Testing & Red Teaming: Conducted attack simulations and red teaming activities on internal applications to identify critical security vulnerabilities (e.g., SQLi, XSS, brute force, authorization flaws) and developed PoCs detailing technical and business impacts.
• Dependency Analysis & Validation: Identified and analyzed over 100 packages/dependencies per application using CVE databases, GHSA, and CVSS score metrics to map third-party component risks.
• False Positive Elimination: Performed manual source code reviews and manual exploit replications based on CVEs to ensure vulnerabilities were true positives, optimizing mitigation priorities.
• Secure SDLC Implementation: Executed security reviews and rigorous testing for every feature addition or application change prior to production deployment.
• Reporting & Cross-Divisional Collaboration: Authored detailed penetration testing reports (findings, risk levels, mitigations) and presented them to both technical teams and non-technical management in clear, accessible language.
• Security Standards Consultation: Provided architecture and security governance compliance recommendations based on CIS Controls, ISO 27001, OWASP, PTES, and NIST SP 800-115 frameworks.