Lead App Security Engineer - PenTesting & DevSecOps

SwipBox A/S; Islamabad; On-site; PKR 2,790,000 - 5,022,000; Full time

Job summary

SwipBox A/S is seeking an experienced security tester to perform penetration testing across web, mobile, API, network, embedded software, firmware, and cloud environments.

You will conduct threat modeling, attack-surface analysis, security architecture reviews, red-team activities, API security testing, and review of code and firmware with remediation guidance.

Applicants typically hold CEH/OSCP or similar certifications and have 7+ years of professional security testing experience.

Qualifications

• Master’s or Bachelor's degree in Software/Computer Engineering or CS.
• 7+ years of professional security testing experience.
• CEH, eCPPT, CRTP, OSCP or equivalent certifications preferred.

Responsibilities

• Perform penetration testing across web, mobile, API, network, embedded software, firmware, and cloud environments.
• Conduct threat modeling, attack-surface analysis, and security architecture reviews.
• Lead red-team activities to simulate real-world attacks and assess security posture.
• Identify vulnerabilities, misconfigurations, and weaknesses; provide remediation guidance.
• Perform API security testing, including REST APIs and authentication mechanisms.
• Review source code and firmware for insecure practices; perform secure DevSecOps integration.
• Prepare detailed penetration testing reports with evidence, risk ratings, and remediation recommendations.
• Mentor junior team members and present findings to stakeholders.

Skills

Penetration testing

Vulnerability assessments

Threat modeling

Red-team activities

Security architecture reviews

CI/CD security

Web security testing

API security testing

Mobile security testing

Cloud security testing

Firmware security testing

Education

Master’s/ Bachelor’s in CS/Engineering

Tools

CEH

eCPPT

CRTP

OSCP

Job description

SwipBox A/S is seeking an experienced security tester to perform penetration testing across web, mobile, API, network, embedded software, firmware, and cloud environments.

You will conduct threat modeling, attack-surface analysis, security architecture reviews, red-team activities, API security testing, and review of code and firmware with remediation guidance.

Applicants typically hold CEH/OSCP or similar certifications and have 7+ years of professional security testing experience.