Senior Penetration Tester

FIRMUS; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Job summary

FIRMUS in Kuala Lumpur is seeking a Penetration Testing Lead to design, scope, and execute advanced offensive security engagements across networks, web, mobile, and cloud environments. You will supervise and mentor junior consultants, deliver comprehensive reports, and provide strategic security recommendations to clients.

The role requires 5+ years of hands-on experience, expertise in MITRE ATT&CK, and proven leadership in Red Team exercises.

Qualifications

• 5+ years of hands-on penetration testing across networks, web, and mobile.
• Experience leading Red Team engagements and delivering reports to executives.
• Strong knowledge of MITRE ATT&CK and vulnerability analysis.

Responsibilities

• Design, scope, and lead security assessments across networks, apps, and cloud.
• Perform offensive security exercises including Red Team engagements.
• Document findings with prioritized, actionable remediation recommendations.
• Collaborate with clients to align testing with business risk.
• Review reports for accuracy and clarity as a QA reviewer.
• Mentor junior consultants and train on testing methodologies.

Skills

Penetration testing

Web security

Mobile security

Red Team leadership

Education

OSCP certification

CREST CRT

Job description

The Penetration Tester will be serving as the Penetration Testing Lead, is a technical leadership role responsible for steering and executing advanced offensive security engagements. This role requires a security practitioner capable of designing, managing, and delivering comprehensive security assessments including penetration testing, red teaming, and application security reviews to identify critical vulnerabilities and assess organizational risk across diverse client environments.

Key Responsibilities

Technical Leadership & Execution

• Design and Scope Engagements: Plan, scope, and lead security assessment activities targeting network infrastructure, web applications, mobile platforms, and cloud environments.
• Advanced Testing: Conduct offensive security exercises, including Red Team exercises, to simulate real-world threats and test defensive capabilities.
• Post-Engagement Analysis: Oversee the thorough documentation of findings, providing clear, actionable, and prioritized recommendations to mitigate identified risks.

Consulting & Reporting

• Client Collaboration: Work directly with clients to understand their security objectives, define testing parameters, and clearly communicate the technical findings and associated business risk.
• Quality Assurance (QA): Serve as a technical QA reviewer for reports and deliverables produced by junior consultants, ensuring accuracy, clarity, and adherence to industry best practices.
• Strategic Advisement: Provide strategic counsel to clients on enhancing their overall security posture, incident response capabilities, and adherence to relevant compliance standards.
• Mentorship: Mentor and train junior consultants, fostering the development of technical skills in penetration testing methodologies, application security, and report writing.

Qualifications & Experience

Essential Technical Expertise

• Proven Expertise: 5+ years of demonstrable experience in hands-on penetration testing, web and mobile application security, and managing Red Team exercise.
• Offensive Security Skills: Expert knowledge of common exploitation techniques, attack methodologies (e.g., MITRE ATT&CK), and vulnerability analysis tools.
• Foundational Knowledge: Broad and deep understanding of core Cybersecurity principles, defensive architectures, and regulatory frameworks.

Educational & Professional Requirements

• Certifications: Possession of industry-leading certifications such as OSCP, CREST CRT or equivalent is highly advantageous.
• Analytical Skills: Exceptional analytical ability and meticulous attention to detail required for complex vulnerability research and reporting.
• Communication: Excellent verbal and written communication skills, with the ability to articulate complex technical concepts to both technical and executive audiences.
• Team Collaboration: Demonstrated ability to lead projects, work effectively on-site, and collaborate seamlessly with cross-functional internal and client teams.
• Location: Commitment to working full-time on-site in WP. Kuala Lumpur.