Red Teaming and Offensive Security

Permata Bank; Tangerang Selatan; On-site; IDR 900,000,000 - 1,300,000,000; Full time

Job summary

Permata Bank seeks a seasoned security professional to lead authorized red team engagements, aligning with MITRE ATT&CK to evaluate defenses across networks, applications, and cloud. You will design objectives, scopes, and success criteria while safely simulating adversary techniques within approved boundaries.

The role requires hands-on experience in offensive security within financial services, strong reporting skills, and a focus on remediation validation and governance.

Qualifications

• Bachelor degree in CS/InfoSec/IT or related field, or equivalent experience.
• Typically 4–7 years in penetration testing, offensive security or red teaming with hands-on assessment.
• Experience operating in regulated financial institutions is advantageous.

Responsibilities

• Design and conduct authorized, risk-based red team engagements across people, process, tech, and third-party exposure.
• Define engagement objectives, scope, target systems, assumptions, rules, approvals, safety constraints, escalation paths and success criteria.
• Develop threat-informed attack scenarios based on assets, actors, techniques, and intelligence.
• Conduct full lifecycle: recon, attack-surface mapping, enumeration, vulnerability discovery, initial access, exploitation, elevation, lateral movement, and objective validation.
• Report findings with remediation recommendations and present to technical owners and management.

Skills

Offensive Security

Red Team Methodology

Tools & Scripting

Detection Awareness

Communication Governance

Education

Bachelor's degree in CS/InfoSec/IT or related

Equivalent relevant experience

Experience in regulated financial institutions

Tools

Nmap

Burp Suite

Metasploit

Python

PowerShell

Bash

Job description

Company Description :

We are one of the top 10 biggest banks in terms of assets in Indonesia and listed in the indonesia Stock Exchange, that offer banking products and services that help people and companies to succeed, creating wealth and growth through our Retail Banking, SME and Wholesale businesses.

Why Permata Bank ?

Here at Permata Bank, you will Learn, Grow, and Make A Difference,

You will have the appetite and the ability to learn many things, challenged to grow beyond ways you can imagine, and see the incredible difference you would have made along the journey.

This is our platform for you. We cannot promise a smooth ride, but rest assured, it is going to be a meaningful journey!

• Learn : We always think innovatively to improve the way we work, making it easier, better and faster.
• Grow : We provide excellent service to customers and encourage excellent performance in our daily work.
• Make a difference : We understand each other and together build strong relationships with internal and external parties based on mutual respect.

Job Description:

Engagement Strategy & Rules of Engagement

• Design and conduct authorized, risk-based red team engagements that simulate realistic adversary objectives across people, process, technology, and third-party exposure.
• Define engagement objectives, scope, target systems, assumptions, rules of engagement, approvals, safety constraints, escalation paths, and success criteria with relevant stakeholders.
• Develop threat-informed attack scenarios based on business-critical assets, plausible threat actors, known attack techniques, and available intelligence.

End-to-End Adversary Simulation

• Conduct the full authorized engagement lifecycle: reconnaissance, external and internal attack-surface mapping, enumeration, vulnerability discovery, initial-access simulation, controlled exploitation, privilege-escalation assessment, lateral-movement simulation, and objective validation.
• Evaluate identity, endpoint, network, infrastructure, cloud, application, and security-control weaknesses in realistic chained attack paths within approved scope.
• Assess persistence and command-and-control exposure through controlled simulation only where explicitly permitted; avoid disruption, destructive actions, and unauthorized data extraction.
• Safely demonstrate potential access to critical systems or sensitive information using agreed proof-of-access techniques and stop conditions.

Detection, Response & Purple Team Collaboration

• Coordinate with SOC, incident response, infrastructure, application, and security engineering teams to evaluate prevention, detection, investigation, and response effectiveness.
• Map relevant observed techniques to MITRE ATT&CK and identify detection gaps, logging deficiencies, response delays, and control weaknesses.
• Facilitate purple team debriefs, detection engineering improvements, and repeatable validation exercises without compromising exercise objectives.

Reporting, Remediation & Governance

• Prepare clear engagement reports detailing objectives, attack paths, prerequisites, evidence, business impact, control failures, detection observations, and prioritized remediation recommendations.
• Present findings to technical owners and management, facilitate remediation discussion, and validate corrective actions through targeted retesting.
• Maintain secure handling of engagement artifacts, credentials, tools, and evidence
• Provide metrics and trends on attack-path exposure, control effectiveness, detection outcomes, and remediation progress for security leadership.

Required Skills:

• Offensive Security: Strong understanding of network protocols, various technology platforms, attack paths scenarios, web/application weaknesses, cloud fundamentals, and enterprise security architecture.
• Red Team Methodology: Ability to plan and execute authorized end-to-end adversary emulation, attack-path analysis, and controlled exploitation with appropriate safeguards.
• Tools & Scripting: Practical experience with Nmap, Burp Suite, Metasploit or equivalent frameworks, common security assessment utilities, Python/PowerShell/Bash scripting, and AI adoption for automation purpose.
• Detection Awareness: Knowledge of MITRE ATT&CK, SIEM, EDR, network telemetry, incident response workflows, and purple team validation.
• Communication & Governance: Strong reporting, evidence management, stakeholder coordination, operational risk assessment, and rules-of-engagement discipline.

Qualifications:

• Bachelor’s degree in Computer Science, Information Security, IT, or related discipline, or equivalent relevant experience.
• Typically 4–7 years in penetration testing, offensive security, red teaming, infrastructure security, or closely related technical security roles, with demonstrable hands-on assessment experience.
• Experience operating in regulated financial institutions and coordinating production-safe exercises is advantageous.

Preferred Skills & Certifications:

• Experience with adversary emulation, cloud red teaming, attack-path assessments, phishing simulations under explicit authorization, and purple team exercises.
• Certifications such as OSCP, CRTO, OSEP, GPEN, GXPN, or equivalent hands‑on offensive security credentials.

Directorates :

Technology

PT. Bank Permata Tbk hereby informs that the company does not impose any charges in the employee recruitment process