AppSec Red Team Engineer - Pen Testing & Threat Modeling

iFAST Corporation; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Job summary

iFAST Corporation is seeking a Cyber Security Engineer (Red Team & Penetration Test) to identify vulnerabilities in our web, mobile, and API applications. You will collaborate with developers and DevSecOps to remediate findings and improve secure coding practices.

The role emphasizes hands-on testing, threat modelling, and security consulting across cloud and container environments, with opportunities to influence CI/CD security and risk reduction across our platforms in Malaysia.

Qualifications

• 2 to 4 years of experience in penetration testing, application security or red teaming.
• Hands-on with Burp Suite, Metasploit, Nmap; knowledge of OWASP Top 10 and API security.
• Proficient in Linux, Windows, AD, TCP/IP, cloud and container infra.
• Proficient in at least one scripting language (Python or Java).
• OSCP, OSEP or similar certifications are a plus.

Responsibilities

• Perform security assessments of web, mobile and API applications using threat modelling, code scanning and penetration testing.
• Plan and run red team exercises against applications and supporting infrastructure within agreed rules of engagement.
• Provide security consulting to development teams on secure design, architecture reviews and threat modelling.
• Work with developers to remediate findings, remove false positives from scan reports and retest fixes.
• Work with DevOps to build tools and automation that improve security in the CI/CD pipeline.
• Develop secure coding standards and train development teams on web and mobile secure coding.

Skills

Analytical skills

Communication skills

Problem solving

Python/Java scripting

Education

Bachelor's degree in CS/Cybersecurity or related field

OSCP, OSEP or similar certifications (preferred)

Tools

Burp Suite

Metasploit

Nmap

Job description

iFAST Corporation is seeking a Cyber Security Engineer (Red Team & Penetration Test) to identify vulnerabilities in our web, mobile, and API applications. You will collaborate with developers and DevSecOps to remediate findings and improve secure coding practices.

The role emphasizes hands-on testing, threat modelling, and security consulting across cloud and container environments, with opportunities to influence CI/CD security and risk reduction across our platforms in Malaysia.