Security Engineer - Offensive Security (PT)

Axiata Digital Labs; Kuala Lumpur; Hybrid; MYR 60,000 - 100,000; Full time

Job summary

Axiata Digital Labs is seeking an experienced security professional to perform vulnerability assessments and manual penetration testing across web, mobile, API, and network environments. You will document findings, propose remediation, and liaise with stakeholders to ensure timely security assessments.

The role requires strong OWASP Top 10 knowledge, Linux-based pentesting experience (Kali, Parrot), and proficiency with Burp Suite, Nuclei, Frida, and Nessus, plus solid English communication.

Qualifications

• 2+ years in vulnerability assessments and penetration testing on web, mobile, API, and networks.
• Strong knowledge of OWASP Top 10 and mitigations.
• Solid networking fundamentals (OSI layers, TCP/IP, protocols).
• Experience with GNU/Linux-based pentesting OS and command line (Kali Linux, Parrot, etc.).
• Experience with automation scripting and at least one programming language.
• Experience with tools like Burp Suite, Nuclei, Frida, Nessus.
• Strong spoken and written English skills.

Responsibilities

• Perform manual pentesting of web, mobile, API and networks to find vulnerabilities.
• Document findings and remediation recommendations for owners.
• Coordinate with internal stakeholders to ensure timely security assessments.
• Regular VA/PT of web, mobile, network and API apps.
• Identify internet exposure of operating companies and evaluate security posture.
• Document vulnerabilities, impact, and recommendations clearly.
• Take ownership of security challenges and drive to completion.

Skills

Vulnerability assessment

Penetration testing

OWASP Top 10

Networking fundamentals

Linux command line

Automation scripting

Programming/scripting

Bug bounty/open-source security

English communication

Tools

Burp Suite

Nuclei

Frida

Nessus

Job description

Key Responsibilities

• Perform manual penetration testing of web application, mobile, API and networks to discover and exploit vulnerabilities
• Clearly document, communicate findings and remediation recommendations to the application/service owners
• Liaise with internal stakeholders to ensure timely delivery of security assessments
• Perform regular VA/PT of web, mobile, network and API applications
• Identify the internet exposure of our operating companies and constantly evaluate the security posture
• Document vulnerabilities, impact, and recommendations in a systematic manner
• Take on security challenges, take ownership of them and drive them to completion.

Required Qualifications

• Minimum 2+ years of experience performing vulnerability assessments and penetration testing on Web/Mobile/Network/API applications
• Excellent understanding of OWASP Top 10 vulnerabilities and it's mitigations
• Clear understanding of networking fundamentals: OSI layers, TCP/IP, protocols, etc.
• Experience working on a GNU/Linux based penetration testing operating system and the command line (such as Kali Linux, Parrot, BlackArch, etc.)
• Experience with automation scripting and fluent in at least one programming/scripting language
• Experience working on open-source and commercial tools like Burp Suite, Nuclei, Frida, Nessus, etc.
• Good spoken and written English skills

Preferred Qualifications

• Security certifications: OSCP, OSWE, CRTP, GIAC certs or equivalent
• Knowledge of Cloud penetration testing: AWS, Azure, etc.
• Knowledge of Windows penetration testing: Active Directory, Azure AD CVE publications, knowledge of exploit development
• Talks/workshops organized at security conferences
• Excellent bug bounty track record
• Open-source contributions made to security tools, scripts & solutions
• Development background and code review capabilitiesExperience with OT penetration testing