Security Consultant (Penetration Testing)

BGC GROUP PTE. LTD.; Singapore; On-site; SGD 70,000 - 110,000; Full time

Job summary

BGC GROUP PTE. LTD. is seeking a security specialist to perform comprehensive security assessments across mobile, web, and backend applications.

You will conduct mobile testing for iOS/Android, perform secure code reviews, and analyse protections while leveraging reverse engineering and dynamic analysis tools. Ideal candidates have 2+ years in penetration testing or application security, strong communication skills, and CREST CRT certification; additional security certs are highly valued.

Qualifications

• Degree in Computer Science, Cybersecurity, Information Security, or related discipline.
• At least 2 years hands-on experience in penetration testing, offensive security, or application security.
• Strong understanding of mobile application security for iOS and Android.
• Experience reviewing code in Swift, Kotlin, Objective-C, Java, or similar.
• Familiarity with reverse engineering and mobile security testing tools (IDA Pro, Ghidra, Frida).
• Knowledge of mobile processor architectures and app internals is advantageous.
• Experience web app pen testing and secure code reviews across stacks.
• Mandatory CREST CRT certification; additional certs like OSCP/OSWE/OSCE/OSEE are highly regarded.
• Excellent communication and report-writing skills; able to present findings to technical and non-technical stakeholders.
• Strong organisational skills to manage multiple assignments independently.

Responsibilities

• Perform security assessments and penetration testing across mobile, web, and backend applications.
• Conduct mobile app security testing on iOS and Android; identify vulnerabilities and remediation.
• Perform secure code reviews for mobile and web apps across languages.
• Analyse security controls and protections (SSL/TLS pinning, root/jailbreak detection, anti-tampering, runtime protections).
• Use reverse engineering and dynamic analysis tools to support assessments.
• Develop or customize security testing tools to improve efficiency.
• Conduct web app penetration testing using recognised methodologies.
• Perform source code reviews to identify security weaknesses.
• Participate in infrastructure and network security assessments as needed.
• Prepare technical reports with remediation recommendations for stakeholders.

Skills

Penetration testing

Mobile security

Secure code reviews

Reverse engineering

Dynamic analysis

CREST CRT

OSCP

OSWE

Education

Bachelor degree in CS/Cybersecurity

Tools

IDA Pro

Ghidra

Frida

Job description

Key Responsibilities

• Perform security assessments and penetration testing across mobile, web, and backend applications to evaluate compliance with recognised security frameworks, regulatory expectations, and industry best practices.
• Conduct mobile application security testing on both iOS and Android platforms, identifying vulnerabilities and recommending remediation.
• Perform secure code reviews for mobile and web applications across multiple programming languages.
• Analyse application security controls and assess the effectiveness of protections such as SSL/TLS pinning, root/jailbreak detection, anti-tampering mechanisms, and runtime protections.
• Utilise industry-standard reverse engineering and dynamic analysis tools to support security assessments.
• Develop or customise security testing tools and extensions to improve testing efficiency where required.
• Conduct web application penetration testing using recognised methodologies and best practices.
• Perform source code reviews across frontend, backend, and mobile applications to identify security weaknesses.
• Participate in infrastructure and network security assessments where required.
• Prepare technical reports, communicate findings clearly, and provide practical remediation recommendations to stakeholders.

Requirements

• Degree in Computer Science, Cybersecurity, Information Security, or a related discipline.
• At least 2 years or more of hands‑on experience in penetration testing, offensive security, or application security.
• Strong understanding of mobile application security, including iOS and Android architecture and security principles.
• Experience reviewing code written in languages such as Swift, Kotlin, Objective‑C, Java, or similar.
• Familiarity with reverse engineering and mobile security testing tools (e.g. IDA Pro, Ghidra, Frida or equivalent).
• Knowledge of mobile processor architectures and application internals is advantageous.
• Experience conducting web application penetration testing and secure code reviews across multiple technology stacks.
• Mandatory CREST CRT certification.
• Additional certifications such as OSCP, OSWE, OSCE, OSEE, cloud security, red teaming, or AI security certifications are highly regarded.
• Excellent communication and report‑writing skills, with the ability to present technical findings to both technical and non‑technical stakeholders.
• Strong organisational skills with the ability to manage multiple assignments independently while meeting project timelines.

Data Privacy Notice

By submitting your resume or personal data, you consent to the collection, use, and disclosure of your personal data for evaluating your suitability for job opportunities and recruitment services. You acknowledge that you have read and agreed to the applicable Privacy Policy for Job Applicants.

EA License

EA License:05C3053