Security Engineer - Offensive Security Team (SDE 2) -
Kredivo Group · Jakarta, ID
Sekilas tentang pekerjaan ini
Di Kredivo Group, Security Engineer pada tim Offensive Security menguji dan memperkuat pertahanan sistem melalui penetration testing, simulasi serangan, serta kolaborasi perbaikan keamanan. Posisi SDE 2 ini berbasis di Jakarta dan ditujukan bagi kandidat berpengalaman dalam pengujian keamanan aplikasi dan infrastruktur.
Tugas utama
- Melakukan vulnerability assessment dan penetration testing pada infrastruktur, aplikasi web, dan mobile.
- Mengevaluasi keamanan sistem dan menyimulasikan serangan untuk menentukan dampak serta prioritas perbaikan.
- Menyusun laporan temuan, risiko, dan rekomendasi mitigasi.
- Berkolaborasi dengan tim IT dan engineering untuk memperbaiki kerentanan.
- Mengotomatisasi pengujian keamanan di CI/CD dan mengembangkan skrip serta tools.
Kualifikasi utama
- Gelar sarjana; bidang IT atau komputasi diutamakan, tetapi tidak wajib.
- Pengalaman vulnerability assessment dan penetration testing untuk aplikasi web, mobile, serta infrastruktur AWS/GCP.
- Memahami standar dan framework seperti OSSTMM, OWASP, atau PTES.
- Memiliki kemampuan bahasa Inggris dan Vietnam yang memadai.
- Sertifikasi penetration testing seperti OSCP atau setara menjadi nilai tambah.
Ringkasan ini dibuat dengan AI dari deskripsi di bawah. Yang berlaku adalah deskripsi lengkapnya di situs Kredivo Group.
Deskripsi pekerjaan
Join our dynamic Offensive Security team in [Jakarta/Vietnam]. This role is pivotal in ensuring our systems remain resilient against potential threats by actively testing and enhancing our defenses. As part of Kredivo’s Group Information Security team, you will report to the Security Team Manager based out of Singapore & work closely with the Kredivo Engineering & Product team.
Perform Vulnerability Assessments and Penetration Testing
Conduct comprehensive vulnerability assessments and penetration tests on infrastructure, web applications, and mobile applications.
Utilize tools such as Metasploit, Burp Suite, Nmap, etc., to identify security weaknesses and potential exploits.
Security Review and Attack Simulation
Evaluate systems from the perspective of external attackers to identify vulnerabilities and assess overall security posture.
Simulate attacks to understand potential impacts and prioritize remediation efforts.
Reporting and Recommendation
Prepare detailed reports documenting findings, risks, and recommended mitigation strategies.
Communicate results effectively to technical teams, management, and other stakeholders.
Collaboration and Remediation
Collaborate closely with IT and engineering teams to prioritize and remediate identified vulnerabilities.
Assist in implementing security controls and best practices to enhance overall security posture.
Automation and Tool Development
Integrate security tools into development and CI/CD pipelines to automate security testing and validation processes.
Develop scripts and tools (using Python, PowerShell, etc.) to streamline security operations and enhance efficiency.
About you
- A bachelor's degree (preferably focus on IT/ computing but not mandatory)
- Experience in vulnerability assessment & penetration testing, focusing on web applications, mobile applications, and infrastructure (AWS, GCP)
- Understand standards and frameworks for vulnerability scanning and penetration testing processes such as OSSTMM, OWASP, PTES, etc.
- Relevant penetration test certifications such as OSCP, or equivalent is a plus
Behavioural & soft skills required
- A decent command on English and Vietnamese are required;
- Self-starter with a proactive attitude and proven ability to work independently with minimal supervision.
- Ownership mindset, demonstrating high self-motivation in leading security initiatives and projects.
- Continuous learner with a strong appetite for experimentation and interest in automating security processes.
- Excellent analytical skills for assessing and solving complex security issues.
- Clear and concise communicator adept at conveying security concepts to technical and non-technical stakeholders.
- Proficient in creating comprehensive security reports and documentation for various audiences.
- Collaborative team player with proven effectiveness in cross-functional teamwork, sharing knowledge to enhance team capabilities.
- Good organisational skills, capable of maintaining detailed documentation for security processes and incidents.
- #LI-AF1