Senior Penetration Testing Engineer

dtcpay; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

dtcpay in Singapore seeks a seasoned penetration tester to lead end-to-end security assessments of web systems, mobile apps and internal networks for the company and its clients. You will own the full pentest lifecycle and deliver actionable remediation guidance.

Responsibilities include Java source code auditing, mobile security testing, and authoring detailed reports, while liaising with project teams and clients to drive secure software delivery.

Qualifications

• Bachelor's degree or above in Computer Science or related field.
• 5+ years of experience in penetration testing / information security, ideally spanning both in-house and security-services (consulting) roles.
• Strong ability to work independently, including owning client and project-team communication as a project lead.

Responsibilities

• Conduct end-to-end penetration testing on web systems, mobile apps, and internal networks for the company and its clients, identifying and validating security vulnerabilities.
• Independently execute the full pentest lifecycle: reconnaissance, vulnerability scanning, vulnerability validation, privilege escalation, and internal network lateral movement.
• Perform in-depth analysis of common and OWASP Top 10 vulnerabilities (SQL injection, XSS, CSRF, command injection, deserialization, etc.) and provide remediation guidance.
• Perform source code audits, covering Java frameworks (Spring, SpringBoot, SpringMVC, MyBatis) and common vulnerability patterns at the code level.
• Conduct mobile (APP) security testing, including decompilation, hardening/packer detection, static/dynamic testing, and API-level penetration testing.
• Independently author penetration test reports and liaise directly with project teams and clients.
• Participate in red team / national-level cyber defense exercises, handling attack monitoring, traceback analysis, and remediation.
• Support Multi-Level Protection Scheme (MLPS Level 3) security assessments.
• Contribute to internal security awareness training programs.

Skills

End-to-end pentesting

Independent project lead

OWASP Top 10 expertise

Python scripting

Java code auditing

Mobile security testing

Vulnerability remediation guidance

Education

Bachelor's degree in Computer Science

Tools

AWVS

Nmap

SqlMap

Burp Suite

AppScan

Eclipse

Job description

• Conduct end-to-end penetration testing on web systems, mobile apps, and internal networks for the company and its clients, identifying and validating security vulnerabilities.
• Independently execute the full pentest lifecycle: reconnaissance, vulnerability scanning, vulnerability validation, privilege escalation, and internal network lateral movement.
• Perform in-depth analysis of common and OWASP Top 10 vulnerabilities (SQL injection, XSS, CSRF, command injection, deserialization, etc.) and provide remediation guidance.
• Perform source code audits, covering Java frameworks (Spring, SpringBoot, SpringMVC, MyBatis) and common vulnerability patterns at the code level.
• Conduct mobile (APP) security testing, including decompilation, hardening/packer detection, static/dynamic testing, and API-level penetration testing.
• Independently author penetration test reports and liaise directly with project teams and clients.
• Participate in red team / national-level cyber defense exercises, handling attack monitoring, traceback analysis, and remediation.
• Support Multi-Level Protection Scheme (MLPS Level 3) security assessments.
• Contribute to internal security awareness training programs.

Requirements

Basic Requirements

• Bachelor's degree or above in Computer Science or a related field.
• 5+ years of experience in penetration testing / information security, ideally spanning both in-house and security-services (consulting) roles.
• Strong ability to work independently, including owning client and project-team communication as a project lead.

Technical Skills

• Proficient in the full penetration testing methodology, including internal network lateral movement (tunneling via ICMP/LCX/SSH, pass‑hash, pass‑ticket, WMI/PsExec lateral movement, etc.).
• Skilled with AWVS, Nmap, SqlMap, Burp Suite, AppScan, and other scanning/testing tools.
• Capable of Java source code auditing, familiar with Fortify, Eclipse, and vulnerability tracing across common frameworks.
• Proficient in Python; able to independently build security tools (directory brute-forcers, subdomain scanners, C-segment scanners, protocol crackers, PoCs/exploits, etc.).
• Experienced in mobile security testing — APP decompilation (AndroidKiller, apktool), hardening/packer identification, dynamic testing with Drozer, etc.
• Familiar with common middleware attack techniques and host security inspection procedures.