Job Responsibilities:
- Perform end-to-end penetration testing on web applications, infrastructure, mobile platforms, and cloud environments.
- Adjust testing techniques to align with evolving architectures, technologies, and project requirements.
- Identify, document, and present findings with actionable, risk-based recommendations.
- Collaborate closely with development, infrastructure, project, and security teams to clarify test prerequisites and propose pragmatic remediation paths.
- Customize assessments to fit the unique needs of both the business and technical environments.
- Continuously monitor threat trends and integrate new tools, exploits, or techniques into the testing workflow.
- Contribute to building and refining internal tools, scripts, and processes to enhance testing efficiency and quality.
Job Requirements:
- 3–5 years of hands-on experience conducting penetration tests across web, mobile, network, and API environments.
- Proficient with industry-standard tools such as Burp Suite , Kali Linux , Nessus Pro , Nmap , and scripting in Python , Bash , or equivalent languages.
- Strong analytical and problem-solving skills, with a creative approach to identifying and exploiting vulnerabilities.
- Solid understanding of frameworks and methodologies, including OWASP , NIST , PTES , and MITRE ATT&CK .
- Ability to tailor testing strategies based on the technical stack and business context.
- Skilled in producing clear, risk-prioritized reports and communicating findings effectively to both technical and non-technical audiences.
- Relevant certifications such as OSCP , OSWE , or eWPTX are advantageous, but not required.
Preferred to have:
- Adaptable and capable of shifting between diverse projects and methodologies.
- Naturally curious and self-driven to explore emerging vulnerabilities and exploit techniques.
- Strong communicator with the ability to translate complex security issues into practical, business-aligned recommendations.
- Balanced approach to security—able to apply rigorous testing without losing sight of operational and business constraints.
* Only HK Citizen/PR applicants
All applications applied through our system will be delivered directly to the advertiser and privacy of personal data of the applicant will be ensured with security.