Senior Application Security Engineer - Red Team & Cloud Security

SwipBox; Islamabad; On-site; PKR 350,000 - 600,000; Full time

Job summary

SwipBox in Islamabad seeks an experienced security testing expert to lead comprehensive penetration testing across web, mobile, API, network, embedded, firmware, and cloud ecosystems. You will perform rigorous assessments of AWS infrastructure and contribute to threat modeling, secure design reviews, and remediation guidance.

The role requires 7+ years of hands-on security testing, with certifications such as CEH, eCPPT, CRTP, or OSCP preferred.

Qualifications

• Master’s or Bachelor’s degree in software/CS or related engineering field.
• 7+ years of professional security testing experience.
• CEH/eCPPT/CRTP/OSCP or equivalent preferred.

Responsibilities

• Perform penetration testing across web, mobile, API, network, embedded software, firmware, and cloud environments.
• Conduct security testing of AWS infrastructure, including IAM, EC2, S3, Lambda, API Gateway, VPC, CloudFront, Cognito.
• Lead penetration-testing engagements and mentor junior team members.
• Prepare detailed penetration testing reports with vulnerabilities, risk ratings, evidence, and remediation recommendations.
• Stay updated with OWASP standards and cloud security best practices.
• Integrate security testing into CI/CD pipelines with SAST, DAST, SCA, IaC, and container security scanning.

Skills

Penetration testing

Security assessments

Threat modeling

CI/CD security

DevSecOps

SAST/DAST/SCA

Embedded security testing

Education

Master's or Bachelor's degree in Software Engineering, Computer Engineering, Telecommunication Engineering, or Computer Science

Tools

CEH

eCPPT

CRTP

OSCP

Job description

SwipBox in Islamabad seeks an experienced security testing expert to lead comprehensive penetration testing across web, mobile, API, network, embedded, firmware, and cloud ecosystems. You will perform rigorous assessments of AWS infrastructure and contribute to threat modeling, secure design reviews, and remediation guidance.

The role requires 7+ years of hands-on security testing, with certifications such as CEH, eCPPT, CRTP, or OSCP preferred.