Senior Penetration Tester RA

Overview

The Senior Penetration Tester will lead end-to-end security engagements across web applications APIs mobile platforms internal networks and cloud infrastructure. This role is responsible for executing technical scoping hands-on penetration testing manual exploit validation and retesting. Beyond identifying vulnerabilities you will deliver actionable prioritized remediation guidance for engineering teams while mentoring junior security assessors through report reviews internal playbook development and continuous knowledge sharing.

Key Responsibilities

• Leadership: Lead technical scoping establish Rules of Engagement (RoE) with stakeholders and execute end-to-end assessments independently
• Hands-on Penetration Testing: Perform deep-dive assessments on Web Mobile (Android/iOS) API (REST/GraphQL) Network Active Directory and Cloud/Container environments with manual validation to eliminate false positives
• Reporting & Deliverables: Produce clear two-tiered reports consisting of an Executive Summary for leadership and reproducible technical details with prioritized remediation steps for developers
• Debriefs & Stakeholder Communication: Lead debrief sessions presenting complex technical findings effectively to both non-technical business leaders and technical engineering teams
• Remediation & Retesting: Conduct retests to verify fix effectiveness and ensure long-term risk mitigation
• Capability Development & Mentoring: Drive continuous improvement by building internal tooling refining checklists/playbooks and mentoring junior team members

Person Specifications

• Minimum 5 years of experience in offensive security OR 7 years in general cybersecurity with at least 4 years exclusively focused on penetration testing
• Proven experience independently managing critical engagements within high-risk sectors (Financial Services Telecommunications E-Commerce or Government)
• Web & API: In-depth knowledge of OWASP Top 10 and WSTG. Expertise in testing authentication/authorization flaws IDOR SSRF insecure deserialization business logic bugs and API vulnerabilities (REST & GraphQL batching/introspection abuse)
• Mobile Security: Deep knowledge of OWASP MASTG. Hands-on experience with static/dynamic analysis on Android & iOS including client-side security bypasses
• Scripting & Tooling: Proficient in Python Bash or PowerShell (Go or C# is a plus). Ability to modify PoCs and build custom scripts rather than relying solely on automated scanners
• Standards & Compliance: Familiarity with PTES OSSTMM NIST SP 800-115 MITRE ATT&CK CVSS v3.1/v4.0 PCI DSS ISO 27001 as well as Indonesian regulations (POJK/SEOJK and UU PDP)
• Preferred Certification (Practical/Hands-on): OSCP (Primary) paired with OSEP OSWE GPEN GWAPT CRTO or CREST CRT
• Bonus / Advanced: OSCE³ GXPN CARTP/CARTS eWPTX or GMOB
• Complementary: CEH CompTIA PenTest

Vendor submissions - 06 months