Senior AppSec Engineer: Penetration Testing & Secure SDLC

SwipBox; Islamabad; On-site; PKR 400,000 - 700,000; Full time

Job summary

SwipBox in Islamabad seeks an experienced Senior Security Tester to perform penetration testing across web, mobile, API, cloud, and embedded environments, and to assess security controls in AWS. You will conduct threat modeling, review architectures, lead red-team activities, and mentor junior staff while integrating security into CI/CD pipelines.

Responsibilities include reporting, coordination with DevOps, and staying current with OWASP and cloud security best practices.

Qualifications

• Master’s or Bachelor’s degree in Software Engineering, Computer Science or related field.
• 7+ years of professional security experience.
• CEH, eCPPT, CRTP, OSCP certifications preferred.

Responsibilities

• Perform penetration testing across web, mobile, API, network, embedded software, firmware, and cloud environments.
• Conduct threat modeling, attack-surface analysis, and security architecture reviews to identify risks.
• Lead red-team activities to simulate real-world attacks and assess security posture.
• Review application source code to identify vulnerabilities and insecure coding practices.
• Integrate security testing and controls into CI/CD pipelines (SAST, DAST, SCA, IaC, container security).
• Prepare detailed penetration testing reports with vulnerabilities, risk ratings and remediation recommendations.

Skills

Penetration testing

Vulnerability assessments

Cloud security

Threat modeling

Red-team

CI/CD security

Code review security

Scripting

Team mentoring

Communication

Education

Master’s or Bachelor’s degree in Software Engineering / CS

7+ years professional security experience

CEH, eCPPT, CRTP, OSCP certifications preferred

Tools

CEH

eCPPT

CRTP

OSCP

Job description

SwipBox in Islamabad seeks an experienced Senior Security Tester to perform penetration testing across web, mobile, API, cloud, and embedded environments, and to assess security controls in AWS. You will conduct threat modeling, review architectures, lead red-team activities, and mentor junior staff while integrating security into CI/CD pipelines.

Responsibilities include reporting, coordination with DevOps, and staying current with OWASP and cloud security best practices.