Sr/Staff Offensive Security Engineer

About the Role

In this role, you will leverage your offensive security and adversary emulation expertise to proactively identify and validate weaknesses across our applications, cloud infrastructure, and corporate environment before real attackers do. You will own the internal penetration testing and red team program, work closely with engineering teams to remediate findings, and partner with the security operations team to turn attack insights into stronger detections and defenses.

Responsibilities:

• Plan and perform penetration tests on web applications, mobile applications (iOS/Android), APIs, and internal/external networks.
• Assess the security of cloud environments (primarily GCP), Kubernetes workloads, CI/CD pipelines, and identity systems such as Azure AD / Entra ID.
• Plan and run red team and adversary emulation exercises based on realistic threat scenarios and the MITRE ATT&CK framework, within agreed rules of engagement.
• Work with the security operations team in purple team exercises to validate and improve detection coverage, alert quality, and incident response readiness.
• Review the security of new features, system designs, and third-party integrations, and perform threat modeling with engineering teams.
• Run the vulnerability management process for offensive findings: triage, risk rating, remediation guidance, and verification of fixes.
• Coordinate and support external penetration tests and the bug bounty program, including scoping, triage, and validating reported issues.
• Write scripts and internal tools to automate reconnaissance, attack surface monitoring, and repetitive testing tasks.
• Write clear reports with risk ratings, proof-of-concept, and actionable remediation steps for both technical and non-technical stakeholders.

Qualifications:

• 3+ years of experience in penetration testing, red teaming, application security, or a related offensive security role.
• Hands-on experience testing web applications, APIs, and mobile applications, with a strong understanding of OWASP Top 10 / OWASP API Security Top 10 / OWASP MASVS.
• Experience with offensive tooling such as Burp Suite, Nmap, Metasploit, BloodHound, Frida, or C2 frameworks (e.g., Cobalt Strike, Sliver, Mythic).
• Familiar with GCP (must-have requirement); experience attacking cloud environments, Kubernetes, and identity platforms is a strong plus.
• Proficiency in scripting (e.g., Python, Go, Bash, or PowerShell) for exploit development, automation, and tool development.
• Strong understanding of network protocols, operating systems (Linux/Windows), Active Directory, and common attack techniques.
• Ability to read and review source code (e.g., Go, Java, JavaScript/TypeScript, Kotlin, Swift) to find security vulnerabilities.
• Experience in the banking, fintech, or financial services industry is a plus.
• Excellent written and verbal communication skills, with the ability to explain complex technical risks to both technical and non-technical audiences.
• Experience working within a collaborative team environment, with a strong sense of ethics and responsible disclosure.
• Preferred Certifications: OSCP, OSEP, OSWE, CRTO, GPEN, GXPN, or equivalent. CVEs, bug bounty records, or CTF achievements are a plus.

Our benefit:

• Competitive compensation including a 13th-month wage and up to 3 months of performance-based bonus.
• Macbook and essential equipment are provided.
• BE Corp budget (vary from your level) is allocated for using services such as transportation, food, and passenger car bookings in Be application.
• The social insurance contribution amount will vary based on the individual's level.
• Annual health checks and premium medical healthcare (PTI) after probation.
• 15 days of annual leave is applied for the entire staff.
• Company trips, team-building activities, and happy hour events are organized on a quarterly or annual basis.