Cybersecurity Senior Offensive & Defensive Engineer(Oniste)

Nexsoll; Bahawalpur Division; On-site; PKR 3,000,000 - 6,000,000; Full time

Benefits offered by this job

Competitive salary

Leadership team focused on security

Job summary

Nexsoll, a privately held digital innovation firm, seeks an elite security expert who thinks like an attacker and builds defenses like an engineer. You will identify critical vulnerabilities, simulate real attacks and implement layered protections across apps, APIs, and cloud infrastructure.

You will harden cloud environments, containers, CI/CD, and IAM, while leading incident response and mentoring the engineering team to bake security into the lifecycle.

Qualifications

• 7+ years of hands-on offensive and/or defensive security experience.
• Proven record of finding critical vulnerabilities (CVEs, bug bounty entries, or real pentest results).
• Deep knowledge of the OWASP Top 10, API security, auth flaws, injections and business logic bugs.
• Experience defending cloud environments (AWS/Azure/GCP) and container/Kubernetes hardening.
• Ability to code/script (Python, Go, Bash) to automate defenses.
• Clear communication to developers and executives about risk.
• Rankings on HackerOne/Bugcrowd/Intigriti or CTF wins; published CVEs or talks.

Responsibilities

• Hunt for critical bugs; run deep penetration tests across apps, APIs, and cloud infra.
• Run red team exercises simulating real attack chains from initial access to exfiltration.
• Design defense-in-depth: WAF, rate limiting, bot mitigation, DDoS protection and zero-trust.
• Harden cloud, containers, CI/CD, secrets management and IAM.
• Set up monitoring, SIEM, alerts; write incident response playbooks.
• Secure the code with threat modeling, SAST/DAST, dependency scanning and secure reviews.
• Lead incident response; coordinate containment, investigation and remediation.
• Raise the bar by training teams and embedding security into the culture.

Tools

Burp Suite

Metasploit

Nmap

Ghidra/IDA

Cobalt Strike

Job description

Company Description

Nexsoll is a privately held digital innovation firm that helps organizations accelerate growth through lead generation, strategic digital marketing, and enhanced customer engagement. Founded in 2024, . Our users trust us with their data, and we treat that as a promise. We’re looking for an elite security expert who thinks like an attacker and builds defenses like an engineer.

The Challenge

Picture this: 10,000 skilled blackhat hackers launch a coordinated attack on our systems at the same time. They probe every API, every login form, every cloud bucket and every employee inbox.

Your job is to make sure they leave with nothing.

You’ll find our critical vulnerabilities before anyone else does, fix them at the root, and build a security setup that holds up against large-scale, persistent, real-world attacks.

What You'll Do

• Hunt for critical bugs. Run deep penetration tests and code reviews across our web apps, APIs, mobile apps, cloud infrastructure and internal networks.
• Think like the adversary. Run red team exercises that simulate real attack chains, from initial access through privilege escalation, lateral movement and data exfiltration.
• Build layered defenses. Design and implement defense-in-depth: WAF, rate limiting, bot mitigation, DDoS protection, zero-trust access and network segmentation.
• Harden everything. Lock down cloud (AWS, Azure or GCP), containers, CI/CD pipelines, secrets management and identity and access management.
• Detect and respond. Set up monitoring, SIEM and alerting, and write incident response playbooks so attacks are caught in minutes, not months.
• Secure the code. Work with developers to build security into the development lifecycle through threat modeling, SAST/DAST, dependency scanning and secure code review.
• Lead incident response. When something happens, you’re the calm voice in the room who contains it, investigates it and makes sure it never happens again.
• Raise the bar. Train the engineering team, set security standards and turn security into part of the culture, not a bottlenec

What You Bring

• 7+ years of hands-on experience in offensive and/or defensive security
• A proven record of finding critical vulnerabilities (CVEs, bug bounty Hall of Fame entries, published research or real pentest results)
• Deep knowledge of the OWASP Top 10, API security, authentication and authorization flaws, injection, SSRF, deserialization and business logic bugs
• Strong experience with tools like Burp Suite, Metasploit, Nmap, Ghidra/IDA, Cobalt Strike or similar
• Solid cloud security experience (AWS, Azure or GCP) and container/Kubernetes hardening
• Experience defending against DDoS, credential stuffing, bot attacks and automated exploitation at scale
• The ability to code and script (Python, Go, Bash or similar) to build tools and automate defenses
• Clear communication: you can explain a critical risk to a developer and to the CEO
• A ranking on HackerOne, Bugcrowd or Intigriti, or CTF competition wins
• Published CVEs, security research or conference talks (DEF CON, Black Hat, BSides)
• Experience with SOC 2, ISO 27001 or PCI-DSS compliance
• Experience with SOC 2, ISO 27001 or PCI-DSS compliance
• Malware analysis, reverse engineering or threat intelligence experience

What We Offer

Competitive salary + performance bonus

A leadership team that takes security seriously