Senior Cybersecurity Consultant, Attack Simulation Group

Cyber Security Agency of Singapore; Singapore; On-site; SGD 120,000 - 160,000; Full time

Job summary

The Cyber Security Agency of Singapore (CSA) invites senior offensive security professionals to join the Attack Simulation Group (ASG). You will lead hands-on penetration testing, red teaming, and adversary simulations across web, mobile, cloud, OT, and telecom environments, delivering realistic security improvements for Critical Information Infrastructure.

You will mentor junior consultants, share knowledge, and help evolve ASG's testing methodologies while operating within government

Qualifications

• 5-8 years of relevant offensive security experience in pentesting or red team work.
• Proven ability to execute real-world attack scenarios beyond automated tests.
• Strong write-up skills to clearly articulate risk and impact.
• Experience across web, mobile, cloud, OT or telecom environments is preferred.
• Industry certifications such as OSCP/CRT/CRTO are desirable.

Responsibilities

• Lead and conduct penetration testing, red teaming, and adversary simulations across diverse environments.
• Execute realistic attack scenarios to assess resilience of critical systems.
• Translate offensive techniques into detections and response improvements.
• Manage engagements end-to-end including planning, reporting, and debriefs with stakeholders.
• Mentor junior consultants and raise the team's technical standards.
• Improve ASG testing methodologies, tooling, and research.
• Contribute to procurement activities and strategic gov't initiatives when required.

Skills

Penetration testing

Red team operations

Adversary tradecraft

Attack simulation

Technical writing

Mentoring

Job description

Description:

You will be part of the Attack Simulation Group (ASG) within the Cyber Security Agency of Singapore (CSA), a specialist team responsible for delivering advanced security testing and adversary-led assessments to strengthen the resilience of Critical Information Infrastructure (CII). This is a senior, hands-on role for experienced offensive security practitioners who want to apply real-world attack techniques to complex, high-impact systems in support of Singapore’s national cyber security mission.

ASG is a technically driven team within CSA focused on realistic attack simulation, penetration testing, red teaming, and purple-teaming outcomes. Our work goes beyond compliance-driven assurance, emphasising hands-on testing, attacker tradecraft, and practical security improvements.

Operating within the realities of government, we value curiosity, adaptability, and out-of-the-box thinking. Specialised training and development opportunities are provided to continuously deepen and expand our technical capabilities, and team members are expected to continuously learn, apply skills across domains, and contribute to the evolution of attack simulation practices across Singapore’s CII.

We also believe in sharing and growing our craft where appropriate. Some of our public work and tooling can be found at: https://github.com/hack-techv2/

Responsibilities:

• Lead and conduct penetration testing, red teaming, and adversary simulation activities across web, mobile, infrastructure, cloud, OT, and telecommunications environments.
• Execute realistic attack scenarios to assess the resilience of Critical Information Infrastructure (CII), including systems supporting essential services.
• Support purple-teaming activities by translating offensive techniques into actionable detection and response improvements.
• Lead engagements end-to-end, including planning, execution, reporting, and technical debriefs with stakeholders.
• Mentor junior consultants and contribute to raising the team’s overall technical standard.
• Drive continuous improvement of ASG’s testing methodologies, tooling, and research, including taking on problem spaces outside your primary domain when required.
• And because this is government, be prepared to occasionally switch gears by contributing to strategic initiatives, supporting and executing procurement activities, participating in industry outreach, or undertaking coordination work, all of which ultimately help us strengthen security outcomes and make Singapore a safer place to live and work.

Why Join ASG at CSA?

• Work on nationally significant systems, including CII, OT, and telecommunications environments rarely accessible outside government.
• Engage in deep, technically challenging work that prioritises realism, learning, and security outcomes over high-volume testing.
• Apply your offensive security expertise to a public mission that directly contributes to Singapore’s cyber resilience.
• Be part of a specialist team that is deliberately building towards strong technical depth, continuous learning, and moving beyond compliance-driven assurance, and help shape what "good" looks like along the way.

Requirements:

• An attacker’s mindset with strong technical understanding of operating systems, networks, and modern enterprise environments.
• Proven ability to identify and execute real-world attack scenarios, beyond automated or checklist-based testing.
• Experience in penetration testing and/or red team operations, with exposure to adversary tradecraft and attack chaining.
• Demonstrated adaptability to transfer skills across technical domains (e.g. web to mobile, IT to OT, on-prem to cloud).
• Strong technical writing skills and the ability to clearly articulate security risks and impact.
• Typically 5-8 years of relevant experience in penetration testing, red team operations, or related offensive security roles, with demonstrated depth in hands-on technical work.
• Relevant industry certifications such as OSCP, CREST (e.g. CRT, CCT), CRTO, or equivalent are desirable.
• That said, we recognise that certifications alone do not define capability. Hands-on experience, problem-solving ability, and technical depth matter more to us than badges.