Red Teaming and Offensive Security

Permata Bank; Tangerang Selatan; On-site; IDR 420,000,000 - 700,000,000; Full time

Job summary

Permata Bank seeks an experienced security professional to lead engagement strategy and rules of engagement for authorized adversary simulations. You will design objectives, scope, and success criteria with stakeholders, and coordinate with SOC and security engineering to validate prevention and response effectiveness.

The role requires hands-on offensive security expertise, strong reporting skills, and experience in regulated financial environments.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, IT, or related discipline.
• Typically 4–7 years in penetration testing, offensive security, red teaming, or related roles.
• Experience operating in regulated financial institutions is advantageous.

Responsibilities

• Design authorized, risk-based red team engagements across people, process, and technology.
• Conduct end-to-end adversary simulations including recon, attack-surface mapping, exploitation, and lateral movement.
• Prepare engagement reports detailing objectives, evidence, and remediation recommendations.
• Coordinate with SOC and incident response teams to evaluate prevention, detection, and response effectiveness.
• Map techniques to MITRE ATT&CK and identify detection gaps.

Skills

Offensive Security

Red Team Methodology

Tools & Scripting

Detection Awareness

Communication & Governance

Education

Bachelor’s degree in Computer Science or related field

Tools

Nmap

Burp Suite

Metasploit

Python

PowerShell

Bash

AI for automation

Job description

We are one of the top 10 biggest banks in terms of assets in Indonesia and listed in the indonesia Stock Exchange, that offer banking products and services that help people and companies to succeed, creating wealth and growth through our Retail Banking, SME and Wholesale businesses.

Why Permata Bank ?

Here at Permata Bank, you will Learn, Grow, and Make A Difference,

You will have the appetite and the ability to learn many things, challenged to grow beyond ways you can imagine, and see the incredible difference you would have made along the journey.

This is our platform for you. We cannot promise a smooth ride, but rest assured, it is going to be a meaningful journey!

• Learn : We always think innovatively to improve the way we work, making it easier, better and faster.
• Grow : We provide excellent service to customers and encourage excellent performance in our daily work.
• Make a difference : We understand each other and together build strong relationships with internal and external parties based on mutual respect.

Job Description:

Engagement Strategy & Rules of Engagement

• Design and conduct authorized, risk-based red team engagements that simulate realistic adversary objectives across people, process, technology, and third-party exposure.
• Define engagement objectives, scope, target systems, assumptions, rules of engagement, approvals, safety constraints, escalation paths, and success criteria with relevant stakeholders.
• Develop threat-informed attack scenarios based on business-critical assets, plausible threat actors, known attack techniques, and available intelligence.

End-to-End Adversary Simulation

• Conduct the full authorized engagement lifecycle: reconnaissance, external and internal attack-surface mapping, enumeration, vulnerability discovery, initial-access simulation, controlled exploitation, privilege-escalation assessment, lateral-movement simulation, and objective validation.
• Evaluate identity, endpoint, network, infrastructure, cloud, application, and security-control weaknesses in realistic chained attack paths within approved scope.
• Assess persistence and command-and-control exposure through controlled simulation only where explicitly permitted; avoid disruption, destructive actions, and unauthorized data extraction.
• Safely demonstrate potential access to critical systems or sensitive information using agreed proof-of-access techniques and stop conditions.
• Coordinate with SOC, incident response, infrastructure, application, and security engineering teams to evaluate prevention, detection, investigation, and response effectiveness.
• Map relevant observed techniques to MITRE ATT&CK and identify detection gaps, logging deficiencies, response delays, and control weaknesses.
• Facilitate purple team debriefs, detection engineering improvements, and repeatable validation exercises without compromising exercise objectives.

Reporting, Remediation & Governance

• Prepare clear engagement reports detailing objectives, attack paths, prerequisites, evidence, business impact, control failures, detection observations, and prioritized remediation recommendations.
• Present findings to technical owners and management, facilitate remediation discussion, and validate corrective actions through targeted retesting.
• Maintain secure handling of engagement artifacts, credentials, tools, and evidence
• Provide metrics and trends on attack-path exposure, control effectiveness, detection outcomes, and remediation progress for security leadership.

Required Skills:

• Offensive Security: Strong understanding of network protocols, various technology platforms, attack paths scenarios, web/application weaknesses, cloud fundamentals, and enterprise security architecture.
• Red Team Methodology: Ability to plan and execute authorized end-to-end adversary emulation, attack-path analysis, and controlled exploitation with appropriate safeguards.
• Tools & Scripting: Practical experience with Nmap, Burp Suite, Metasploit or equivalent frameworks, common security assessment utilities, Python/PowerShell/Bash scripting, and AI adoption for automation purpose.
• Detection Awareness: Knowledge of MITRE ATT&CK, SIEM, EDR, network telemetry, incident response workflows, and purple team validation.
• Communication & Governance: Strong reporting, evidence management, stakeholder coordination, operational risk assessment, and rules-of-engagement discipline.

Qualifications:

• Bachelor’s degree in Computer Science, Information Security, IT, or related discipline, or equivalent relevant experience.
• Typically 4-7 years in penetration testing, offensive security, red teaming, infrastructure security, or closely related technical security roles, with demonstrable hands on assessment experience.
• Experience operating in regulated financial institutions and coordinating production-safe exercises is advantageous.

Preferred Skills & Certifications:

• Experience with adversary emulation, cloud red teaming, attack-path assessments, phishing simulations under explicit authorization, and purple team exercises.
• Certifications such as OSCP, CRTO, OSEP, GPEN, GXPN, or equivalent hands-on offensive security credentials.

Directorates :

Technology

PT. Bank Permata Tbk hereby informs that the company does not impose any charges in the employee recruitment process