Red Team & Sec Test / Specialist-Jakarta

Lazada; Indonesia; On-site; IDR 100.000.000 - 200.000.000; Full time

Job summary

A leading e-commerce platform in Indonesia is seeking a seasoned Offensive Security Specialist to execute red team operations that simulate real-world attack scenarios. The ideal candidate will have extensive experience in offensive security, particularly in web and cloud environments, and proficiency in tools such as Cobalt Strike and Metasploit. This role involves collaboration with various teams to enhance security measures and threat resilience.

Qualifications

• 5-8+ years in offensive security, including Red Team and penetration testing.
• Deep expertise in at least 3 domains like Web/API, Cloud, or Active Directory.
• Strong understanding of advanced security controls.

Responsibilities

• Plan and execute full-spectrum red team operations.
• Simulate advanced persistent threats across environments.
• Deliver actionable findings to technical teams and executives.

Skills

Offensive security experience

Python

Cobalt Strike

Burp Suite Pro

MITRE ATT&CK

Creative problem-solving

Education

Bachelor's in Computer Science or Cybersecurity

Tools

Metasploit

Havoc

Sliver

Job description

Department:

Technology

Location:

Department: Technology

Job Description

Execute sophisticated adversary emulation campaigns that mirror real-world threat actors. You'll be the attacker that helps make our defenses stronger.
Core Responsibilities
● Plan and execute full-spectrum red team operations using MITRE ATT&CK & ATLAS frameworks
● Simulate advanced persistent threats across web, mobile, cloud, and enterprise environments
● Bypass cutting-edge security controls (EDR, NDR, WAFs, SIEM/SOAR) to test real-world resilience
● Develop custom exploits and tools in Python, Go, C#, PowerShell, or Rust
● Collaborate with Blue Teams in Purple Team exercises to enhance detection capabilities
● Research emerging threats targeting e-commerce platforms
● Deliver actionable findings to technical teams and executives

Attack Domains
● Web & API: Business logic flaws, SSRF, OAuth/JWT attacks, injection vulnerabilities, OWASP top 10.
● Mobile: iOS/Android: reverse engineering, OWASP MASTG
● Cloud & AD: Multi-cloud attacks (AWS, GCP, Azure), Kerberoasting, DCSync, Golden Ticket attacks
● Emerging Tech: AI/ML systems, serverless, containers, identity frameworks

Job Requirements

What You Need
Required Experience
● 5-8+ years in offensive security (Red Team, Penetration Testing, Adversary Emulation)
● Deep expertise in at least 3 domains: Web/API, Cloud, Active Directory, Mobile, or AI/ML security
● Proficiency in Python, Go, C#, PowerShell/Bash for exploit development
● Hands-on experience with C2 frameworks (Cobalt Strike, Havoc, Sliver), Metasploit, Burp Suite Pro
● Strong understanding of Windows/Linux internals, networking, and enterprise architectures
● Experience with MITRE ATT&CK and / or ATLAS framework and Purple Team engagements
Preferred
● Advanced certifications: OSEP, OSWE, OSED, GXPN, CRTE/CRTO, CCT Web/INF
● Public security contributions: CVEs, open-source tools, conference talks, research
● Experience with AI/LLM security, blockchain, IoT, or e-commerce platforms
● Bachelor's in Computer Science, Cybersecurity, or equivalent experience

What Makes You Great
● Adversarial mindset: Creative and persistent in finding non-obvious attack paths
● Technical depth: Can develop custom exploits and explain complex risks clearly
● Collaborative: Committed to making Blue Teams stronger through your attacks
● Ethical: Unwavering professionalism with sensitive systems and data
● Continuous learner: Passionate about pushing offensive security boundaries
Ready to be the threat that makes us stronger? Join our team !

Application Form

First Name

Last Name

Email

Country code

Education

Linkedin

Why are you applying to Lazada?

Upload resume

Select file

Nothing is selected

Only supports docx, jpg, pdf, jpeg, png. File size maximum 5MB. File Name maximum 300 characters.

Upload additional document

Select file

Nothing is selected

Only supports docx, jpg, pdf, jpeg, png. File size maximum 5MB. File Name maximum 300 characters.