Red Team & Sec Test / Specialist-Hangzhou / Jakarta

• Plan and execute full-spectrum adversary emulation campaigns to assess the security posture of e-commerce platforms, infrastructure, and applications.
• Simulate real-world threat actors using MITRE ATT&CK & MITRE ATLAS-aligned tactics, techniques, and procedures (TTPs) across web, mobile, cloud, and corporate environments.
• Conduct stealthy red team operations including reconnaissance, initial access, lateral movement, privilege escalation, command and control (C2), and data exfiltration.
• Bypass advanced security controls such as EDR, NDR, WAFs, and SIEM/SOAR systems to test detection and response capabilities under realistic conditions.

Perform in-depth assessments of critical domains:

• Web & API: Exploit business logic flaws, SSRF, OAuth/JWT misconfigurations, and injection vulnerabilities; assess AI/LLM systems for security flaws as per MITRE ATLAS.
• Mobile: Reverse engineer iOS and Android apps, bypass certificate pinning, analyze insecure data storage, and exploit IPC mechanisms.
• Cloud & AD: Execute attacks on multi-cloud environments (AWS, GCP, Azure) and Active Directory (e.g., Kerberoasting, DCSync, ACL abuse, Golden Ticket).
• Develop custom tools, payloads, and exploits in Python, Go, C#, PowerShell, or Rust to evade detection and achieve operational objectives.
• Collaborate with Blue Teams through structured Purple Team exercises to improve detection logic, SOC visibility, and incident response playbooks.
• Conduct proactive threat intelligence research on e-commerce-targeting adversaries to inform emulation scenarios and campaign planning.
• Document attack narratives, technical findings, business impact, and strategic remediation recommendations in comprehensive reports.
• Communicate results effectively to technical teams and executive leadership to drive risk mitigation and security investment decisions.
• Continuously research emerging attack surfaces, including AI/ML systems, serverless architectures, containers, and identity frameworks.

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field (or equivalent experience).
• 5–8+ years of hands-on experience in offensive security roles such as Red Teaming, Adversary Emulation, or Advanced Penetration Testing.
• Deep expertise in at least three of the following domains:
• Web & API security (Burp Suite Pro, OWASP ZAP, Correlium, Nuclei)
• Cloud security (AWS, GCP, Azure – IAM, serverless, containers)
• Active Directory exploitation (Mimikatz, BloodHound, Impacket, certipy, )
• Mobile application security (Frida, Objection, Ghidra / IDA Pro, JEB)
• Hands-on experience assessing AI/ML systems in production, including:
• Prompt injection and jailbreaking of LLMs
• Data leakage via model outputs or embeddings
• Abuse of AI-powered chatbots for fraud or social engineering
• Security of vector databases and semantic search components

• Proficiency in programming and scripting languages such as Python, Go, C#, PowerShell / Bash for automation, tool development, and exploit creation.
• Mastery of offensive tools and frameworks:

C2 frameworks (Cobalt Strike, Havoc, Sliver, Merlin)
Penetration testing suites (Metasploit, Burp Suite Pro)
Cloud exploitation tools (Pacu, ScoutSuite)

• Strong understanding of operating system internals (Windows, Linux), TCP/IP networking, and enterprise security architectures.
• Demonstrated ability to develop, modify, or extend exploits for modern systems and applications.
• Experience using MITRE ATT&CK framework to design and evaluate attack simulations.
• Proven track record in Purple Team engagements—collaborating with defenders to enhance detection and response capabilities.
• Familiarity with threat intelligence platforms, disassemblers (IDA Pro, Ghidra), and debuggers for vulnerability analysis.

Preferred Qualifications

• Advanced offensive security certifications: OSEP, OSWE, OSED, GXPN, CRTE/CRTO (OSCP is considered foundational), CCT Web / CCT INF.
• Public contributions to the security community: CVEs, open-source tools, conference talks (e.g., Black Hat, DEF CON), technical blogs, or whitepapers.
• Hands-on experience assessing emerging technologies: AI/LLM security, prompt injection, smart contracts, or blockchain-based systems, IOT.
• Experience in e-commerce, fintech, or large-scale digital platforms with complex attack surfaces.
• Ability to explain complex technical risks clearly to both engineers and executives.
• Unwavering ethical standards and professionalism when handling sensitive systems and data.

Key Attributes

• Adversarial mindset: creative, analytical, and persistent in uncovering non-obvious attack paths.
• Exceptional problem-solving skills and attention to detail in high-pressure, stealth-driven operations.
• Passion for continuous learning, research, and pushing the boundaries of offensive security.
• Commitment to improving organizational resilience by making the Blue Team stronger.