VAPT Security Engineer: Exploitability & Remediation

Ascendion; Cyberjaya; On-site; MYR 120,000 - 180,000; Full time

Job summary

Ascendion is seeking a hands-on security engineer to support external attack surface management and crowdsourced security programmes. You will manually validate vulnerabilities affecting externally exposed applications and systems, and stay involved through risk assessment, remediation and retesting.

If you enjoy determining real-world exploitability rather than just reviewing scanner results, this role offers meaningful impact across security and engineering teams in a fast-moving environment.

Qualifications

• Hands-on vulnerability assessment & testing across web apps and APIs.
• Ability to reproduce vulnerabilities and verify exploitability.
• Experience with vulnerability disclosure programmes preferred.
• Collaborates with teams to drive remediation and retesting.

Responsibilities

• Investigate vulnerabilities affecting externally exposed applications, infrastructure and services.
• Manually reproduce reported vulnerabilities and determine real-world exploitability.
• Perform vulnerability assessment and penetration testing using tools such as Burp Suite, Nmap, cURL or equivalent security tools.
• Conduct reconnaissance, service fingerprinting and hands-on web/application security testing.
• Prioritise vulnerabilities based on exploitability, exposure, severity and potential business impact.
• Validate findings through crowdsourced security programmes.
• Explain findings to application and security teams and agree remediation actions.
• Track vulnerabilities through remediation and retesting.
• Monitor vulnerability trends and remediation progress.

Skills

VAPT

Vulnerability validation

Burp Suite

Nmap

cURL

Web security testing

Tools

Burp Suite

Nmap

cURL

Job description

Ascendion is seeking a hands-on security engineer to support external attack surface management and crowdsourced security programmes. You will manually validate vulnerabilities affecting externally exposed applications and systems, and stay involved through risk assessment, remediation and retesting.

If you enjoy determining real-world exploitability rather than just reviewing scanner results, this role offers meaningful impact across security and engineering teams in a fast-moving environment.