Security Consultant (Penetration Testing)

TL;DR

Security Consultant (Penetration Testing): Leading and delivering full-lifecycle penetration testing engagements for global clients with an accent on web, mobile, and infrastructure security. Focus on identifying technical vulnerabilities, producing high-impact reports, and providing consultative security advice to stakeholders.

Location: Hybrid (Kuala Lumpur office); Applicants are required to be resident in Malaysia

Company

Award-winning global provider of cyber security services specializing in red teaming, penetration testing, and GRC.

What you will do

• Perform penetration testing across a wide variety of systems, including web, mobile, and infrastructure.
• Manage the full engagement lifecycle from kick-off calls and testing to report delivery and debriefs.
• Produce thorough technical reports demonstrating business impact and providing remediation guidance.
• Support presales activities by scoping engagements and advising on testing methodologies.
• Build and maintain professional consultative relationships with global clients.
• Mentor less experienced consultants and analyze emerging security threats.

Requirements

• Hands-on experience in penetration testing.
• Proficiency in at least one domain: web application, mobile application, or infrastructure testing.
• Ability to communicate complex risks to both technical and non-technical audiences.
• Must be a resident of Malaysia.
• In-depth knowledge of networking and application security.

Nice to have

• BSc degree in a relevant technical discipline or equivalent experience.
• Certifications such as OSCP, CRT, CCT, CISSP, or CCSP.
• Cloud security certifications (e.g., AWS Security Specialty or Azure AZ-500).
• Contributions to open-source security tools, security blogs, or CTF participation.
• Specialization in exploit development or reverse engineering.

Culture & Benefits

• Collaborative team environment with strong technical depth and a focus on continuous learning.
• Diverse career progression paths within a full-spectrum cyber security unit.
• Shift-based working arrangements with additional allowances for non-standard hours.
• Exposure to high-profile clients, including central banks and critical national infrastructure.