Senior Penetration Tester

MSBU is a dynamic IT staffing and recruitment company founded in 2019, specializing in on-demand talent solution for the technology industry. With a strong focus on client and candidate success, we deliver exceptional services through our SLA commitment and innovative crowdsourcing ecosystem.

Our expertise spans various technology domain, including software development, mobile technology, data, infrastructure, cybersecurity, product, and UX . As a leader in the industry, we are proud to have established the Freelance Tech Recruiter Community (FRC) , connecting over 250 technology recruiter to collaborate, learn, and grow together.

To learn more about PT. MSBU Konsultan Indonesia, please visit our website at:

website: https://msbu.co.id/id/

Instagram: https://www.instagram.com/msbukonsultan/?__pwa=1

Linkedln: https://www.linkedin.com/company/msbukonsultan/posts/?feedView=all

Key Responsibilities:

• Leadership: Lead technical scoping, establish Rules of Engagement (RoE) with stakeholder, and execute end to end assessment independently
• Hands on Penetration Testing: Perform deep dive assessment on Web, Mobile (Android/iOS), API (REST/GraphQL), Network, Active Directory, and Cloud/Container environment with manual validation to eliminate false positive
• Reporting & Deliverables: Produce clear, two-tiered report consisting of an Executive Summary for leadership and reproducible technical details with prioritized remediation step for developer
• Debrief & Stakeholder Communication: Lead debrief session, presenting complex technical finding effectively to both non technical business leader and technical engineering team
• Remediation & Retesting: Conduct retests to verify fix effectiveness and ensure long-term risk mitigation
• Capability Development & Mentoring: Drive continuous improvement by building internal tooling, refining checklists/playbook and mentoring junior team member

Requirement:

• Minimum 4 years of experience in offensive security or 7 years in general cybersecurity with at least 4 years exclusively focus on penetration testing, experience bug bounty.
• Proven experience independently managing critical engagement within high-risk sector (Financial Services, Telecommunication, E-Commerce or Government)
• Web & API: In-depth knowledge of OWASP Top 10 and WSTG. Expertise in testing authentication/authorization flaws, IDOR, SSRF, insecure deserialization, business logic bugs, and API vulnerabilities (REST & GraphQL batching/introspection abuse)
• Mobile Security: Deep knowledge of OWASP MASTG. Hands on experience with static/dynamic analysis on Android & iOS, including client-side security bypasses
• Scripting & Tooling: Proficient in Python, Bash, or PowerShell (Go or C# is a plus). Ability to modify PoCs and build custom script rather than relying solely on automated scanner
• Standard & Compliance: Familiarity with PTES, OSSTMM, NIST SP 800-115, MITRE ATT&CK, CVSS v3.1/v4.0, PCI DSS, ISO 27001, as well as Indonesian regulations (POJK/SEOJK and UU PDP)
• Preferred Certification (Practical/Hands-on): OSCP (Primary), paired with OSEP, OSWE, GPEN, GWAPT, CRTO, or CREST CRT
• Bonus / Advanced: OSCE³, GXPN, CARTP/CARTS, eWPTX, or GMOB
• Complementary: CEH, CompTIA PenTest+

Application Question(s):

• Are you proficient in Python, Bash, or PowerShell for security scripting?
• Do you have experience producing technical penetration testing report and presenting finding to client/stakeholder?
• Which penetration testing or framework tools have you work with?
• Do you have experience participating in bug bounty program or conduct independent vulnerability research?
• Do you have hands on experience performing Android and iOS security assessment using static and dynamic analysis techniques?

Education:

• S1 (Required)

Experience:

• Industry Information Technology: 1 year (Required)
• professional do you have in penetration testing: 4 years (Required)

Language:

• English (Required)

License/Certification:

• Certified Ethical Hacker (Required)
• CompTIA PenTest+ (Required)

Work Location: In person