Penetration Tester

Aleph (Formerly Red Alpha Cyber); Singapore; Ibrido; SGD 90.000 - 160.000; Tempo pieno

Descrizione del lavoro

Aleph (Formerly Red Alpha Cyber) in Singapore seeks a Penetration Tester to perform real security research across web, infrastructure, cloud, AI and mobile environments. You will report to the Team Lead and collaborate with a small team of security researchers in an international, technical setting, tackling complex problems and live client engagements.

The ideal candidate has 3+ years in pen testing/security research, OSCP/CRT certification, and a strong independent work ethic with excellent

Competenze

• 3+ years of hands-on experience in penetration testing and/or security research.
• Infra and network pen testing including Active Directory, with fluency in Windows/Linux internals.
• Manual source code review and vulnerability research.
• OSCP or CREST CRT certification mandatory.
• Based in Singapore with valid work authorization.
• Strong research mindset and technical curiosity.
• Experience using AI tools to support security testing or research.
• Ability to work independently and on client engagements.
• Excellent written and verbal English communication.
• Availability to work in a hybrid model in Singapore.

Mansioni

• Conduct penetration testing and security research across web apps, infrastructure, cloud, AI, and mobile environments.
• Take ownership of security reporting with accountability for final output and real-world impact.
• Present vulnerabilities and recommendations to clients and their teams.
• Build internal security tools, methodologies, automation, and workflows.
• Contribute to red team and adversary emulation engagements.
• Independently investigate unfamiliar technologies and attack surfaces.

Conoscenze

Penetration testing

Security research

AI-driven security workflows

Independent problem solving

Formazione

OSCP or CREST CRT certification

Degree or equivalent practical experience

Strumenti

Python

Node.js

Descrizione del lavoro

We're looking for a Penetration Tester who wants to do real security research across web, infrastructure, cloud, AI and mobile environments.

Our work spans web applications, infrastructure and networks, cloud and Kubernetes environments, AI systems, mobile applications, and source code. For us, penetration testing is not just about running tools, it's about understanding how systems work, challenging assumptions, and conducting real security research.

You’ll report to the Team Lead and work alongside a small team of security researchers in an international, collaborative, and highly technical environment. You’ll work independently on complex problems and together with the team on live client engagements.

We're looking for someone curious and hungry to learn, someone who goes deep without being told to, would rather understand the system than simply run the tool, and genuinely enjoys security research.

Responsibilites

• Conduct penetration testing and security research across web applications, infrastructure and networks, cloud and Kubernetes environments, AI systems, mobile applications, and source code
• Take ownership of security reporting. We use AI tools to accelerate drafting, but you are accountable for the final output - including technical accuracy, root-cause analysis, and real-world business impact
• Present vulnerabilities, findings, and recommendations clearly to clients and their technical teams
• Build internal security tools, methodologies, automation, and agentic workflows that enable the team to work faster and go deeper
• Contribute to red team and adversary emulation engagements
• Independently investigate unfamiliar technologies, attack surfaces, and complex technical problems

Must Have Requirements

• 3+ years of hands-on experience in penetration testing and/or security research-mandatory
• Deep expertise in at least two of the following areas:
• Infrastructure and network penetration testing, including Active Directory, with real fluency in Windows and Linux internals, the protocols underneath, and privilege escalation
• Manual source code review and vulnerability research
• OSCP or CREST CRT certification- mandatory
• Currently based in Singapore with valid work authorization- mandatory
• Strong research mindset, technical curiosity, and the ability to independently investigate unfamiliar technologies and attack surfaces
• Hands-on experience using AI tools to support security testing, research, automation, or tool development, with a strong interest in exploring new AI-driven security workflows
• Ability to work independently on deep technical problems and collaboratively on live client engagements
• Excellent written and verbal English communication skills
• Availability to work in a hybrid model in Singapore, including regular work at client sites

Nice to Have

• Existing CAT1 or CAT2A security clearance
• Proficiency in Python or Node.js
• CREST CCT APP or CCT INF, or Offensive Security certifications beyond OSCP, such as OSWE, OSEP, or OSED
• Security research publications, strong CTF performance, or a demonstrated bug bounty track record
• Experience with mobile application penetration testing across Android and iOS, as well as thick-client testing
• Cloud penetration testing experience across AWS, Azure, or GCP, including containers and Kubernetes
• Red team experience, including reconnaissance, adversary emulation, and stealth techniques
• AI security expertise, including prompt injection and indirect prompt injection, jailbreaks, RAG and agent security, and the OWASP Top 10 for LLM Applications
• Degree in Computer Science, Information Security, Engineering, or a related discipline - or equivalent practical experience
• Commensurate with experience and qualifications

By submitting your application for this position, you consent to the collection, use, and disclosure of your personal data by Aleph (Formerly Red Alpha) for the purpose of i) employment facilitation and ii) data and statistical analysis. You may find out more information on the PDPA policies at https://www.redalphacyber.com/privacy-policy.