Cyber Security Engineer (Red Team & Penetration Test)

iFAST Corporation; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Job summary

iFAST Corporation is seeking a Cyber Security Engineer (Red Team & Penetration Test) to identify vulnerabilities in our web, mobile, and API applications. You will collaborate with developers and DevSecOps to remediate findings and improve secure coding practices.

The role emphasizes hands-on testing, threat modelling, and security consulting across cloud and container environments, with opportunities to influence CI/CD security and risk reduction across our platforms in Malaysia.

Qualifications

• 2 to 4 years of experience in penetration testing, application security or red teaming.
• Hands-on with Burp Suite, Metasploit, Nmap; knowledge of OWASP Top 10 and API security.
• Proficient in Linux, Windows, AD, TCP/IP, cloud and container infra.
• Proficient in at least one scripting language (Python or Java).
• OSCP, OSEP or similar certifications are a plus.

Responsibilities

• Perform security assessments of web, mobile and API applications using threat modelling, code scanning and penetration testing.
• Plan and run red team exercises against applications and supporting infrastructure within agreed rules of engagement.
• Provide security consulting to development teams on secure design, architecture reviews and threat modelling.
• Work with developers to remediate findings, remove false positives from scan reports and retest fixes.
• Work with DevOps to build tools and automation that improve security in the CI/CD pipeline.
• Develop secure coding standards and train development teams on web and mobile secure coding.

Skills

Analytical skills

Communication skills

Problem solving

Python/Java scripting

Education

Bachelor's degree in CS/Cybersecurity or related field

OSCP, OSEP or similar certifications (preferred)

Tools

Burp Suite

Metasploit

Nmap

Job description

Cyber Security Engineer (Red Team & Penetration Test)

We are looking for an application security professional to find vulnerabilities and business logic weaknesses in our business applications. You will work with developers and DevSecOps to get them fixed.

Responsibilities:

• Perform security assessments of web, mobile and API applications using threat modelling, code scanning and penetration testing.
• Plan and run red team exercises against applications and supporting infrastructure within agreed rules of engagement.
• Provide security consulting to development teams on secure design, architecture reviews and threat modelling.
• Work with developers to remediate findings, remove false positives from scan reports and retest fixes.
• Work with DevOps to build tools and automation that improve security in the CI/CD pipeline.
• Develop secure coding standards and train development teams on web and mobile secure coding.

Requirements:

• Bachelor’s degree in computer science, cybersecurity or a related field, or equivalent experience.
• 2 to 4 years of experience in penetration testing, application security or red teaming.
• Hands‑on with Burp Suite, Metasploit, Nmap and similar tools; strong knowledge of OWASP Top 10 and API security.
• Good understanding of Linux, Windows, Active Directory, TCP/IP, cloud and container infrastructure.
• Proficient in at least one scripting or programming language (e.g. Python, Java).
• Relevant certifications (OSCP, OSEP or similar) are a plus.
• Ability to think outside the box and find creative ways to bypass security controls and defenses.
• Excellent written and verbal communication skills.
• Strong analytical and problem-solving skills.

Why Join Us?

• Work on modern AppSec practices instead of traditional “checklist security”
• Gain hands‑on exposure to AI‑assisted security tooling and threat intelligence
• Collaborate directly with engineering teams on real‑world systems
• Build highly transferable skills across security, cloud, DevOps, and AI‑era engineering
• Grow your career in one of the fastest‑evolving domains in tech

iFAST Corporation Ltd. (“iFAST Corp”) is a global digital banking and wealth management platform headquartered in Singapore. Incorporated in the year 2000 in Singapore and listed on the SGX‑Mainboard in December 2014 (stock code: AIY), iFAST Corp is also present in Hong Kong, Malaysia, China and UK. The Group provides a comprehensive range of investment products and services, to financial advisory (FA) firms, banks, financial institutions, internet companies, multinational companies, as well as retail and high net worth investors in Asia.

iFAST Corporation Ltd. (“iFAST Corp”) is a global digital banking and wealth management platform headquartered in Singapore. Incorporated in the year 2000 in Singapore and listed on the SGX‑Mainboard in December 2014 (stock code: AIY), iFAST Corp is also present in Hong Kong, Malaysia, China and UK. The Group provides a comprehensive range of investment products and services, to financial advisory (FA) firms, banks, financial institutions, internet companies, multinational companies, as well as retail and high net worth investors in Asia.