PENETRATION TESTER

Bateriku; Shah Alam; On-site; MYR 70,000 - 90,000; Full time

Job summary

A cybersecurity firm in Shah Alam, Malaysia, is seeking a professional to perform source code security reviews and assess risks related to various programming languages. The ideal candidate will conduct server assessments, produce detailed audit-grade deliverables, and collaborate with developers to validate security fixes. Knowledge of industry standards and collaboration skills are essential for success.

Qualifications

• Experience in performing source code security reviews in various languages.
• Ability to conduct server and OS hardening assessments.
• Knowledge of risk assessment methodologies for software components.

Responsibilities

• Perform source code security reviews to find vulnerabilities.
• Assess risks related to Node.js and provide improvement recommendations.
• Collaborate with teams to validate fixes and employ remediation.

Skills

Source code security review

Risk assessment

Security hardening

Testing scenarios

Technical findings documentation

Collaboration with developers

Automation for testing

Job description

• Perform source code security reviews (Java/NET/Python/Node/Go/etc) to find logic flaws, authentication/authorization bugs, injection risks, insecure deserialization, secrets in source, crypto misuse, and insecure third-party libs.
• Assess Node js runtime and package-related risks (dependency chain vulnerabilities, unsafe native modules, environment variable/secret handling, npm/yarn lockfile issues), and recommend SCA/SBOM improvements.
• Conduct server and OS hardening assessments, privilege escalation analysis, and persistence technique discovery.
• Run authenticated and unauthenticated test scenarios; produce reproducible exploits or proof-of-concepts where safe and permitted.
• Produce audit-grade deliverables: executive summary, technical findings, impact/risk ratings, CVSS mapping, step-by-step exploitation evidence, and prioritized remediation guidance suitable for PCI-DSS and ISO27001 audits.
• Collaborate with developers and infra engineers to validate fixes and re-test remediations.
• Design and maintain internal pentest methodologies, checklists and playbooks aligned to PCI-DSS (such as penetration testing requirements) and ISMS controls (Annex A).
• Participate in threat modelling, secure code training, and vulnerability triage sessions.
• Keep pentest tooling, scripts, and knowledge up to date contribute to automation for repeatable testing (CI/CD scans, SCA, DAST, SAST pipelines).
• When required, coordinate with Approved Scanning Vendors (ASVs), QSAs, or external auditors for compliance validation.

Be careful - Don’t provide your bank or credit card details when applying for jobs. Don't transfer any money or complete suspicious online surveys. If you see something suspicious, report this job ad .