Security Engineer - Red Team

Security Engineer / Security Engineer – Red Team
Location: Petaling Jaya, Malaysia
Work Mode: Fully Onsite
Experience: 3–5 years

Job Summary

We are looking for a Security Engineer / Senior Security Engineer – Red Team with strong hands-on experience in Vulnerability Assessment, Penetration Testing (VAPT), Red Team operations, and adversary simulation.

The candidate will be responsible for identifying security weaknesses, conducting penetration tests, simulating real-world attacks, developing security tooling, and helping security and technology teams strengthen their defenses.

Key Responsibilities

• Plan and execute Red Team, Purple Team, VAPT, and adversary simulation activities.
• Identify and exploit vulnerabilities across enterprise environments.
• Conduct penetration testing across Windows, Linux/Unix, macOS, Active Directory and Azure AD environments.
• Research and apply offensive security Tactics, Techniques and Procedures (TTPs).
• Perform reconnaissance, exploitation, privilege escalation and post-exploitation activities.
• Develop or customize scripts and tools for reconnaissance, automation and security testing.
• Understand and work with Command & Control (C2) frameworks.
• Modify known exploits and develop/customize exploits without relying entirely on tools such as Metasploit.
• Prepare detailed security assessment reports for both technical and management audiences.
• Develop and maintain Red/Purple Team SOPs, methodologies, checklists and Rules of Engagement (ROE).
• Provide recommendations to improve security posture and reduce identified risks.

Requirements

• 3–5 years of experience in Red Team, Penetration Testing or Offensive Security.
• At least 3 years of hands-on VAPT experience.
• Strong knowledge of OWASP Top 10 and web application security.
• Good understanding of networking fundamentals, TCP/IP, protocols and OSI layers.
• Hands-on experience with Kali Linux or other penetration-testing Linux distributions.
• Strong knowledge of penetration testing tools and offensive security techniques.
• Good understanding of C2 frameworks and their usage/customization.
• Ability to understand, modify and develop exploits manually.
• Good communication and technical reporting skills.
• Good spoken and written English.

Good to Have

• Certifications such as OSCP, OSCE, CRTP, GIAC or equivalent.
• Experience with Tenable security solutions.
• Strong Active Directory / Azure AD penetration testing experience.
• Knowledge of CVE research and exploit development.
• Bug bounty or security research experience.
• Contributions to open-source security tools/projects.
• Programming or scripting experience and ability to review code.