Cybersecurity Engineer (Penetration Testing)

MODE FAIR SDN BHD; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Benefits offered by this job

On-site work at Sunway Tower

Job summary

ModeFair SDN BHD in Kuala Lumpur is seeking a hands-on Cybersecurity Engineer (Penetration Testing) to perform end-to-end testing across web apps, APIs, cloud, network and endpoints. You will leverage AI agents to speed recon, evidence gathering and retests, while owning method, scope and quality.

You will report to the CTO as the first in this role, building testing processes and delivering actionable findings with remediation guidance. On-site only at Sunway Tower, Kuala Lumpur.

Qualifications

• At least 2 years of hands-on penetration testing, red team or security validation.
• Practical testing across web apps and at least some API, cloud, network, identity and endpoints
• Uses AI tools daily in work
• Writes clear findings with severity, impact and fix guidance
• Working knowledge of OWASP, CVEs and MITRE ATT&CK
• Experience testing cloud-hosted systems (AWS and Huawei Cloud) and Linux/Windows

Responsibilities

• Penetration testing & validation
• Plan and run hands-on tests on web apps, APIs, cloud, network, identity and endpoints within scope
• Find exploitable issues and prove impact with evidence
• Write practical findings and fixes owners can act on
• Retest fixes and track closure with CTO and system owners
• Support purple-team and security validation with SOC when needed
• Help improve secure build practices from testing insights
• Use Claude Code and scripts to speed recon, checks, evidence and reporting
• Prefer build-or-script over buying a scanner when not cost-effective
• Keep tests repeatable across releases

Skills

Penetration testing

Red team

AI tools

Scripting

OWASP

Cloud security

Linux

Windows

Education

CEH

CPTE

MITRE ATT&CK certification

CCPT

CCRTS

OSCP

RCCE

CompTIA Security+

GSEC

Tools

Claude Code

Python

Bash

PowerShell

Job description

Cybersecurity Engineer (Penetration Testing)

We are hiring a hands‑on Cybersecurity Engineer (Penetration Testing) for our Kuala Lumpur office, open to mid‑level or senior candidates. Seniority does not change the job: you do the hands‑on work yourself. You report to the CTO and find real weaknesses before attackers do. This is not a report‑only, scanner‑only or checkbox seat.

This is a new role, and you will be the first and only person in it when you join. You won't be working alone, though: you will use AI agents to help with recon, testing, evidence gathering, reporting and retests. We are building penetration testing and security validation from the ground up with the CTO, so you will set up how testing gets done here.

You are expected to work independently and drive penetration testing with the CTO's direction, not wait to be tasked ticket by ticket.

A real part of this role is speeding up recon, custom checks, evidence packing and retests with Claude Code and AI agents, while you stay accountable for method, scope and quality. Commercial scanners are fine when they earn the cost.

Full on‑site, Monday–Friday at Sunway Tower, Jalan Ampang, Kuala Lumpur. No hybrid or remote.

Key responsibilities

• Penetration testing & validation
• Plan and run hands‑on tests on web apps, APIs, cloud, network, identity and endpoints within agreed scope
• Find exploitable issues, not only scanner noise, and prove impact with clear evidence
• Write practical findings and fixes owners can act on
• Retest fixes and track closure with the CTO and system owners
• Support purple‑team and security validation work with the SOC when needed
• Help improve secure build practices (app, cloud, infra) from what testing shows
• Automation & AI
• Use Claude Code (or comparable) and scripts to speed recon, custom checks, evidence and reporting, responsibly
• Prefer build‑or‑script before buy when a commercial scanner does not earn the cost
• Keep methods repeatable so tests stay consistent across releases

Skills & experience required

• At least 2 years of hands‑on penetration testing, red team or security validation, not theory‑only or scanner‑only. We consider mid‑level and senior candidates, and both roles are hands‑on.
• Practical testing across web apps and at least some of API, cloud, network, identity and endpoints
• Uses AI tools daily in your work
• Can write clear findings with severity, impact and fix guidance
• Comfortable scripting (e.g. Python, Bash or PowerShell) for custom checks
• Working knowledge of OWASP, common CVEs and MITRE ATT&CK
• Experience testing cloud‑hosted systems (AWS and Huawei Cloud preferred), Linux, Windows and modern web stacks
• Must hold at least two active (not expired) certifications from the lists below, with at least one from the Penetration Testing list; three or more strongly preferred: Penetration Testing
• Certified Ethical Hacker (CEH)
• Mile2 Certified Penetration Testing Engineer (CPTE)
• MITRE ATT&CK penetration testing certification
• Certified Cloud Penetration Tester (CCPT)
• CREST Certified Red Team Specialist (CCRTS)
• Offensive Security Certified Professional (OSCP)
• Rocheston Certified Cybersecurity Engineer (RCCE)
• CompTIA Security+
• CompTIA SecurityX
• GIAC Security Essentials (GSEC)
• Can operate with limited supervision in a lean SME team
• Aligned with the CTO; accelerate real risk clearly; verify remediation stuck
• Willing to support urgent validation after serious incidents when needed

Nice to have

• Hands‑on with Claude Code or similar AI engineering tools to speed real testing work, not chat‑only
• Open to building your own security tools with Claude Code (willing to self‑learn)
• Bug bounty, CTF or purple‑team experience
• Testing in a lean team without a large commercial toolkit budget
• Light exposure to SOC and incident response work

About the company

ModeFair is an expanding tech venture that excels in GovTech. We provide a holistic suite of services, ranging from strategic counsel and conceptualisation to UI/UX design, custom‑made development & integration, and routine IT management.

We aim to retain strong talent with a conducive working environment and competitive benefits. Our culture is fast‑paced: everyone uses AI heavily in their daily work, delivery speed and efficiency matter, and we hold people accountable for how they use their time. We promote trust, responsibility, and open communication — and we expect high ownership.