Security Engineer - Offensive Security Team (SDE 2) -

Kredivo Group; Jakarta Pusat; On-site; IDR 300,000,000 - 520,000,000; Full time

Job summary

Kredivo Group is seeking an Offensive Security professional in Jakarta to lead vulnerability assessments and penetration testing across IT infrastructure, web and mobile apps. You will simulate external attacks, review security posture, and communicate findings to technical teams.

The role emphasizes collaboration with engineering to remediate issues and to automate security testing within CI/CD pipelines. Strong scripting ability and relevant certifications are valued.

Qualifications

• Experience in vulnerability assessment and penetration testing across web, mobile, and infrastructure (AWS, GCP).
• Familiarity with OSSTMM, OWASP, PTES frameworks.
• Penetration testing certifications such as OSCP are a plus.

Responsibilities

• Perform vulnerability assessments and penetration testing on infrastructure, web and mobile apps.
• Conduct security reviews and attack simulations to identify weaknesses.
• Prepare detailed reports with risks and mitigation recommendations.
• Collaborate with IT and engineering to remediate findings and strengthen controls.
• Develop scripts/tools to automate security testing and validation in CI/CD pipelines.

Skills

Vulnerability assessment

Penetration testing

Security risk assessment

Automation scripting

CI/CD security

Communication

Education

Bachelor's degree in IT/ Computing

Tools

Metasploit

Burp Suite

Nmap

Job description

Join our dynamic Offensive Security team in Jakarta. This role is pivotal in ensuring our systems remain resilient against potential threats by actively testing and enhancing our defenses. As part of Kredivo’s Group Information Security team, you will report to the Security Team Manager based out of Singapore & work closely with the Kredivo Engineering & Product team.

About the Job:

• Perform Vulnerability Assessments and Penetration Testing:
• • Conduct comprehensive vulnerability assessments and penetration tests on infrastructure, web applications, and mobile applications.
  • Utilize tools such as Metasploit, Burp Suite, Nmap, etc., to identify security weaknesses and potential exploits.
• Security Review and Attack Simulation:
• • Evaluate systems from the perspective of external attackers to identify vulnerabilities and assess overall security posture.
  • Simulate attacks to understand potential impacts and prioritize remediation efforts.
• Reporting and Recommendation:
• • Prepare detailed reports documenting findings, risks, and recommended mitigation strategies.
  • Communicate results effectively to technical teams, management, and other stakeholders.
• Collaboration and Remediation:
• • Collaborate closely with IT and engineering teams to prioritize and remediate identified vulnerabilities.
  • Assist in implementing security controls and best practices to enhance overall security posture.
• Automation and Tool Development:
• • Integrate security tools into development and CI/CD pipelines to automate security testing and validation processes.
  • Develop scripts and tools (using Python, PowerShell, etc.) to streamline security operations and enhance efficiency.

About you:

• A bachelor's degree (preferably focus on IT/ computing but not mandatory)
• Experience in vulnerability assessment & penetration testing, focusing on web applications, mobile applications, and infrastructure (AWS, GCP)
• Understand standards and frameworks for vulnerability scanning and penetration testing processes such as OSSTMM, OWASP, PTES, etc.
• Relevant penetration test certifications such as OSCP, or equivalent is a plus

Behavioural & soft skills required:

• A decent command on English and Vietnamese are required;
• Self-starter with a proactive attitude and proven ability to work independently with minimal supervision.
• Ownership mindset, demonstrating high self-motivation in leading security initiatives and projects.
• Continuous learner with a strong appetite for experimentation and interest in automating security processes.
• Excellent analytical skills for assessing and solving complex security issues.
• Clear and concise communicator adept at conveying security concepts to technical and non-technical stakeholders.
• Proficient in creating comprehensive security reports and documentation for various audiences.
• Collaborative team player with proven effectiveness in cross-functional teamwork, sharing knowledge to enhance team capabilities.
• Good organisational skills, capable of maintaining detailed documentation for security processes and incidents. #LI-AF1