Security Engineer - Vulnerability Management & VAPT

Ascendion; Cyberjaya; On-site; MYR 60,000 - 120,000; Full time

Job summary

Jora Malaysia is seeking a hands-on Security Engineer to support the external attack surface management and crowdsourced security programmes, bridging offensive security and enterprise vulnerability management.

You will manually validate vulnerabilities affecting externally exposed applications and systems, reproduce findings, assess exploitability, and coordinate remediation with engineering teams, retesting to confirm fixes.

Qualifications

• Hands-on experience in vulnerability management, assessment & testing (VAPT).
• Proven ability to manually validate security vulnerabilities and assess real-world exploitability.
• Experience with web apps, APIs or external services testing.

Responsibilities

• Investigate vulnerabilities affecting externally exposed applications, infrastructure and services.
• Manually reproduce reported vulnerabilities and determine their real-world exploitability.
• Perform vulnerability assessment and penetration testing using tools such as Burp Suite, Nmap, cURL or equivalent security tools.
• Conduct reconnaissance, service fingerprinting and hands-on web/application security testing.
• Prioritise vulnerabilities based on exploitability, exposure, severity and potential business impact.
• Validate findings submitted through crowdsourced security and vulnerability disclosure programmes.
• Work with application, infrastructure and security teams to explain findings and agree practical remediation actions.
• Track vulnerabilities through remediation and independently verify that fixes have resolved the issue.
• Monitor vulnerability trends, outstanding findings and remediation progress.

Skills

Vulnerability management

VAPT

Security testing

Burp Suite

Nmap

cURL

Exploitation assessment

Cross-team collaboration

Tools

Burp Suite

Nmap

cURL

Job description

Jora Malaysia is seeking a hands-on Security Engineer to support the external attack surface management and crowdsourced security programmes, bridging offensive security and enterprise vulnerability management.

You will manually validate vulnerabilities affecting externally exposed applications and systems, reproduce findings, assess exploitability, and coordinate remediation with engineering teams, retesting to confirm fixes.