{"id":2981690,"url":"https://alion.io/job/cake-by-vpbank-srstaff-offensive-security-engineer","title":"Sr/Staff Offensive Security Engineer","company":{"id":49440,"name":"Cake by VPBank","domain":"cake.vn","url":"https://alion.io/company/cake-by-vpbank","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"A","score":87,"open_postings":16,"ghost_share":0,"stale_share":0.313,"repost_share":0,"time_to_fill_p50_days":84,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ho Chi Minh City, Vietnam"],"countries":["VN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19000,"max_usd":45000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":724},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"BloodHound","optional":false},{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"Cobalt Strike","optional":false},{"name":"Frida","optional":false},{"name":"GCP","optional":false},{"name":"JavaScript","optional":false},{"name":"Kotlin","optional":false},{"name":"Kubernetes","optional":false},{"name":"Metasploit","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Mythic","optional":false},{"name":"Nmap","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Sliver","optional":false},{"name":"Swift","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-21T04:55:23Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-28T00:11:16Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"About the Role\nIn this role, you will leverage your offensive security and adversary emulation expertise to proactively identify and validate weaknesses across our applications, cloud infrastructure, and corporate environment before real attackers do. You will own the internal penetration testing and red team program, work closely with engineering teams to remediate findings, and partner with the security operations team to turn attack insights into stronger detections and defenses.\nResponsibilities:\nPlan and perform penetration tests on web applications, mobile applications (iOS/Android), APIs, and internal/external networks.\nAssess the security of cloud environments (primarily GCP), Kubernetes workloads, CI/CD pipelines, and identity systems such as Azure AD / Entra ID.\nPlan and run red team and adversary emulation exercises based on realistic threat scenarios and the MITRE ATT&CK framework, within agreed rules of engagement.\nWork with the security operations team in purple team exercises to validate and improve detection coverage, alert quality, and incident response readiness.\nReview the security of new features, system designs, and third-party integrations, and perform threat modeling with engineering teams.\nRun the vulnerability management process for offensive findings: triage, risk rating, remediation guidance, and verification of fixes.\nCoordinate and support external penetration tests and the bug bounty program, including scoping, triage, and validating reported issues.\nWrite scripts and internal tools to automate reconnaissance, attack surface monitoring, and repetitive testing tasks.\nWrite clear reports with risk ratings, proof-of-concept, and actionable remediation steps for both technical and non-technical stakeholders.\nQualifications:\n3+ years of experience in penetration testing, red teaming, application security, or a related offensive security role.\nHands-on experience testing web applications, APIs, and mobile applications, with a strong understanding of OWASP Top 10 / OWASP API Security Top 10 / OWASP MASVS.\nExperience with offensive tooling such as Burp Suite, Nmap, Metasploit, BloodHound, Frida, or C2 frameworks (e.g., Cobalt Strike, Sliver, Mythic).\nFamiliar with GCP (must-have requirement); experience attacking cloud environments, Kubernetes, and identity platforms is a strong plus.\nProficiency in scripting (e.g., Python, Go, Bash, or PowerShell) for exploit development, automation, and tool development.\nStrong understanding of network protocols, operating systems (Linux/Windows), Active Directory, and common attack techniques.\nAbility to read and review source code (e.g., Go, Java, JavaScript/TypeScript, Kotlin, Swift) to find security vulnerabilities.\nExperience in the banking, fintech, or financial services industry is a plus.\nExcellent written and verbal communication skills, with the ability to explain complex technical risks to both technical and non-technical audiences.\nExperience working within a collaborative team environment, with a strong sense of ethics and responsible disclosure.\nPreferred Certifications: OSCP, OSEP, OSWE, CRTO, GPEN, GXPN, or equivalent. CVEs, bug bounty records, or CTF achievements are a plus.\nOur benefit:\nCompetitive compensation including a 13th-month wage and up to 3 months of performance-based bonus.\nMacbook and essential equipment are provided.\nBE Corp budget (vary from your level) is allocated for using services such as transportation, food, and passenger car bookings in Be application.\nThe social insurance contribution amount will vary based on the individual's level.\nAnnual health checks and premium medical healthcare (PTI) after probation.\n15 days of annual leave is applied for the entire staff.\nCompany trips, team-building activities, and happy hour events are organized on a quarterly or annual basis.","description_format":"text","description_chars":3836,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Apple Macbook"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Digital Banks & Neobanks"],"lifecycle":[{"event":"open","at":"2026-10-21T07:17:16Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":6,"expected_fill_days":84,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/cake-by-vpbank-srstaff-offensive-security-engineer","json_url":"https://alion.io/job/cake-by-vpbank-srstaff-offensive-security-engineer.json","meta":{"generated_at":"2026-10-28T04:49:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"search","counted_by":"address","units_charged":0,"used_today":0,"day_limit":null,"remaining_today":null,"minute_limit":null,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49440},"rest":"https://alion.io/mcp/rest/get_company?id=49440"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcake-by-vpbank-srstaff-offensive-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcake-by-vpbank-srstaff-offensive-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcake-by-vpbank-srstaff-offensive-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cake-by-vpbank-srstaff-offensive-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcake-by-vpbank-srstaff-offensive-security-engineer"}]}