Penetration Tester - Sr. Associate

Crowe Indonesia; Jakarta Pusat; On-site; IDR 450,000,000 - 750,000,000; Full time

Job summary

Crowe Indonesia is seeking a seasoned penetration tester to lead end-to-end engagements across networks, web apps, APIs, cloud, and code. You will translate complex findings into practical remediation guidance for clients.

This role requires strong hands-on experience, leadership, and the ability to communicate security risks clearly to diverse stakeholders, while mentoring junior staff and improving testing methodologies.

Qualifications

• 4+ years of cybersecurity experience with hands-on penetration testing beyond automated tools.
• Proven leadership of pentesting engagements in a consulting environment.
• Strong knowledge of network, web, cloud, and infrastructure security; secure coding principles.
• Excellent communication to articulate findings to diverse stakeholders.
• Certifications such as OSCP, OSWE, CRTO, CREST, GXPN are highly preferred.
• Strong project management and multi-client prioritization.

Responsibilities

• Lead end-to-end penetration testing engagements across networks, web apps, APIs, cloud, and source code.
• Conduct vulnerability analysis, risk validation, and create client-ready reports with remediation guidance.
• Design and execute advanced attack simulations to assess security posture.
• Engage with clients to understand business context and security objectives.
• Manage project scope, timelines, and deliverables with quality focus.
• Provide technical leadership by reviewing junior assessments and mentoring.
• Continuously enhance testing methodologies with emerging threats and best practices.
• Collaborate with internal teams to deliver integrated cybersecurity solutions.
• Contribute to internal knowledge assets and best practices.
• Support incident response engagements with expert technical insight.

Skills

Penetration testing

Threat analysis

Client communication

Project management

Mentorship

Threat research

Independent thinking

Education

OSCP

OSWE

CRTO

CREST

GXPN

Job description

• Lead and deliver end-to-end penetration testing engagements across network infrastructures, web applications, APIs, cloud environments, and source code in accordance with recognized security standards and methodologies.
• Conduct in-depth vulnerability analysis, risk validation, and impact assessment, producing high-quality client-ready reports with clear prioritization and practical remediation guidance.
• Design and execute advanced attack simulations to assess clients’ security posture and resilience against real-world threat scenarios.
• Act as a trusted cybersecurity advisor, engaging closely with clients to understand business context, regulatory requirements, and security objectives.
• Manage penetration testing project scope, timelines, and deliverables, ensuring consistent quality, accuracy, and on-time delivery.
• Provide technical leadership by reviewing assessments conducted by junior team members and offering structured guidance and mentorship.
• Continuously enhance testing methodologies by incorporating emerging threats, tools, and best practices aligned with industry developments.
• Collaborate with internal consulting teams (e.g., GRC, SOC, Blue Team) to deliver integrated cybersecurity solutions tailored to client needs.
• Contribute to the development of internal knowledge assets, frameworks, and best practices to support scalable consulting services.
• Support security incident response engagements and post-incident analysis, providing expert technical insight when required.

Job Qualifications

• Minimum 4+ years of professional experience in cybersecurity, with substantial hands-on exposure to manual penetration testing beyond automated tools.
• Proven track record in leading penetration testing or offensive security engagements within a consulting or professional services environment.
• Strong technical knowledge of network, application, cloud, and infrastructure security, including secure coding principles.
• Excellent communication and consulting skills, with the ability to articulate technical findings and risks to diverse client stakeholders.
• Industry-recognized certifications such as OSCP, OSWE, CRTO, CREST, GXPN, or equivalent are highly preferred.
• Strong project management and prioritization skills, with the ability to manage multiple client engagements concurrently.
• Demonstrated independence, sound technical judgment, and a structured problem-solving approach.
• Strong commitment to continuous learning, threat research, and the advancement of offensive security capabilities.