Vulnerability and Penetration Tester

Total Information Management Corp.; Philippines; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

Total Information Management Corp. is seeking an Offensive Security Engineer to lead red team and purple team engagements, testing defenses and driving measurable security improvements. This role blends advanced offensive techniques with blue team knowledge to emulate real-world threats and identify detection gaps.

Bridge offense and defense—delivering actionable improvements across on-prem and cloud environments. A CS/IT degree and 3+ years of pentesting experience are required.

Qualifications

• Graduate of Computer Science/Information Technology.
• At least 3 years of Vulnerability and Penetration Testing experience.

Responsibilities

• Plan and execute full-scope red team engagements from recon to objective completion.
• Perform adversary emulation using MITRE ATT&CK techniques and living-off-the-land methods.
• Conduct purple team exercises with blue teams to tune detections and alerts.
• Develop and maintain custom offensive tooling (Python, Go, PowerShell, C/C++).
• Test web/app exploitation, AD domination, and cloud/mobile security controls.

Skills

Networking & Protocols

OS Internals

Web Technologies

Security Concepts

Threat Emulation

Education

Graduate of Computer Science/Information Technology

Tools

Python

Go

PowerShell

C/C++

Job description

Job Summary:

As an Offensive Security Engineer, will act as an elite adversary simulator, leading full-scope red team and purple team engagements to test and strengthen organizational defenses. This role combines advanced offensive techniques with deep blue team knowledge to emulate real-world threats, identify detection gaps, and drive measurable security improvements. Bridge offense and defense—making this a high-impact, high-reward position with hybrid red/purple skills.

Job Duties and Responsibilities:

• Plan and execute full-scope red team engagements — from initial reconnaissance/OSINT through persistence, lateral movement, privilege escalation, and objective completion (e.g., data exfil, ransomware simulation)
• Perform advanced adversary emulation using real-world TTPs mapped to MITRE ATT&CK (including living-off-the-land, evasion of EDR/XDR, AMSI/ETW bypass)
• Conduct purple team exercises — work side-by-side with blue teams/SOC to test detections in real-time, provide instant feedback, and help tune rules/alerts based on observed attack paths
• Develop and maintain custom offensive tooling (Python, Go, PowerShell, C/C++ for implants, C2 frameworks, evasion payloads)
• Perform specialized testing: web/app exploitation, Active Directory domination, cloud attacks (AWS/Azure/GCP), mobile/wireless

Qualifications:

• Graduate of Computer Science/Information Technology
• At least 3 years of Vulnerability and Penetration Testing experience

Knowledge and skills in:

• Networking & Protocols – deep understanding of TCP/IP, OSI model, subnetting, routing, DNS, HTTP/HTTPS, SMP, LDAP, Kerberos, etc.
• Operating Systems Internals – linux (especially), windows, active directory architecture, file systems, processes, memory management
• Web Technologies – HTTP architecture, client/server-side languages (JavaScript, PHP, Python, .NET, Java) cookies, sessions, authentication flows
• Security concepts – MITRE ATT&Ck framework, OWASP Top 10, common vulnerabilities (CVEs), defense evasion techniques, living-off-the-land