Lead Penetration Tester: Web, API & Cloud Security

Lancesoft Indonesia; Jakarta Pusat; On-site; IDR 400,000,000 - 700,000,000; Full time

Job summary

Lancesoft Indonesia is seeking a Senior Penetration Tester to lead end-to-end security engagements across web apps, APIs, mobile, networks, and cloud. You will perform hands-on testing, validate findings, and provide actionable remediation guidance while mentoring junior assessors.

Candidates should have 5+ years in offensive security (or 7+ years cybersecurity with pentesting focus) and strong OWASP/WSTG knowledge, plus OSCP or equivalent practical certifications.

Qualifications

• Minimum 5 years of offensive security experience, OR 7 years in cybersecurity with at least 4 years focused on pentesting.
• Proven experience managing critical engagements in high-risk sectors (Finance, Telecom, E‑commerce, government).
• Web & API: strong knowledge of OWASP Top 10 and WSTG; testing authentication/authorization, IDOR, SSRF and API vulnerabilities.
• Mobile Security: familiarity with OWASP MASTG; hands-on analysis on Android/iOS and bypass techniques.
• Certifications (Practical): OSCP preferred, with OSWE/OSEP/GWAPT/GPEN/CREST CRT as additions.

Responsibilities

• Lead technical scoping, RoE setup with stakeholders, and execute end-to-end assessments.
• Perform deep-dive testing on Web, Mobile, API, Network, Active Directory, and Cloud environments with manual validation.
• Produce executives’ summary and technical reports with prioritized remediation steps.
• Lead debriefs and communicate findings to both business leadership and engineers.
• Conduct retests to verify fixes and mentor junior team members; contribute to internal playbooks.

Skills

Penetration testing

Leadership

Reporting

Mentoring

Scripting & tooling

Tools

Python

Bash

PowerShell

Go/C# (plus)

Job description

Lancesoft Indonesia is seeking a Senior Penetration Tester to lead end-to-end security engagements across web apps, APIs, mobile, networks, and cloud. You will perform hands-on testing, validate findings, and provide actionable remediation guidance while mentoring junior assessors.

Candidates should have 5+ years in offensive security (or 7+ years cybersecurity with pentesting focus) and strong OWASP/WSTG knowledge, plus OSCP or equivalent practical certifications.