{"id":3396170,"url":"https://alion.io/job/kalibrr-senior-cybersecurity-specialist","title":"Senior Cybersecurity Specialist","company":{"id":50060,"name":"Kalibrr","domain":"kalibrr.com","url":"https://alion.io/company/kalibrr","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":true,"listed_via":null,"ats_vendor":"Manatal","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["PH"],"hiring_countries_total":1,"salary":{"min":null,"max":4000,"currency":"USD","period":"month","gross":null,"usd_annual":48000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Acunetix","optional":false},{"name":"Amazon Aurora","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Apache Kafka","optional":false},{"name":"AWS","optional":false},{"name":"bandit","optional":false},{"name":"Binary Ninja","optional":false},{"name":"BloodHound","optional":false},{"name":"Burp Suite","optional":false},{"name":"Checkmarx","optional":false},{"name":"Checkov","optional":false},{"name":"CI/CD","optional":false},{"name":"Clair","optional":false},{"name":"ClickHouse","optional":false},{"name":"Cobalt Strike","optional":false},{"name":"Cosign","optional":false},{"name":"Cutter","optional":false},{"name":"Deep Linking","optional":false},{"name":"DNS","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Falco","optional":false},{"name":"Fortify","optional":false},{"name":"Frida","optional":false},{"name":"Ghidra","optional":false},{"name":"GitLab CI","optional":false},{"name":"Gitleaks","optional":false},{"name":"gosec","optional":false},{"name":"GraphQL","optional":false},{"name":"gRPC","optional":false},{"name":"Grype","optional":false},{"name":"Hashcat","optional":false},{"name":"IAM","optional":false},{"name":"IDA Pro","optional":false},{"name":"Impacket","optional":false},{"name":"John the Ripper","optional":false},{"name":"kube-bench","optional":false},{"name":"kube-hunter","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"Metasploit","optional":false},{"name":"MobSF","optional":false},{"name":"Nessus","optional":false},{"name":"Nikto","optional":false},{"name":"NIST CSF","optional":false},{"name":"Nmap","optional":false},{"name":"Objection","optional":false},{"name":"OpenVAS","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"PCI DSS","optional":false},{"name":"PKI","optional":false},{"name":"PostgreSQL","optional":false},{"name":"Prowler","optional":false},{"name":"Python","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"Radare2","optional":false},{"name":"Red Teaming","optional":false},{"name":"Rest API","optional":false},{"name":"ScoutSuite","optional":false},{"name":"Semgrep","optional":false},{"name":"SIEM","optional":false},{"name":"Sigstore","optional":false},{"name":"Sliver","optional":false},{"name":"Snyk","optional":false},{"name":"SOC 2","optional":false},{"name":"SonarQube","optional":false},{"name":"Splunk","optional":false},{"name":"SQLmap","optional":false},{"name":"TCP/IP","optional":false},{"name":"Tcpdump","optional":false},{"name":"Terrascan","optional":false},{"name":"tfsec","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Trivy","optional":false},{"name":"TruffleHog","optional":false},{"name":"Wazuh","optional":false},{"name":"WebSockets","optional":false},{"name":"Wireshark","optional":false},{"name":"Assembly","optional":true},{"name":"Docker","optional":true},{"name":"Git","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-10-28T12:31:39Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-06T08:33:45Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"Senior Cybersecurity Specialist\nCompany: Billease - First Digital Finance Corporation (FDFC)\nLocation: Philippines (hybrid / remote-friendly) ·\nType: Full-time\nTeam: Security Engineering ·\nReports to: VP of Engineering / CTO\nCompensation: Up to ~USD 4,000 / month, negotiable based on experience (plus benefits - see below)\nAbout the role\nBillease operates consumer lending, merchant checkout, and digital banking products handling sensitive financial and personal data at scale. We run a cloud-native, microservices architecture on AWS/EKS, built primarily in Go and Python, backed by PostgreSQL/Aurora, Kafka, and ClickHouse, with native Android and iOS apps.\nWe're looking for a hands-on Senior Cybersecurity Specialist who can break our systems before anyone else does - and then help us build them so they can't be broken. This is a deeply technical, offensive-minded role that also drives secure-by-design practices across engineering. You'll run penetration tests, hunt for exploitable flaws across our apps, APIs, protocols, and infrastructure, and bring a modern, AI-augmented approach to finding and triaging security issues at scale.\nThis is an individual-contributor role with significant influence. You will not be managing a team - you will be the person engineers and leadership turn to for the hard security questions.\nWhat you'll do\nPlan and execute penetration tests and red-team exercises against web apps, mobile apps, APIs, microservices, cloud infrastructure, and internal tooling.\n\nPerform mobile application security testing (Android & iOS) - static and dynamic analysis, runtime instrumentation, SSL pinning bypass, local storage and secrets review, and reverse engineering.\n\nDiscover and prove exploitability of vulnerabilities across network and application protocols (TLS, HTTP/2, gRPC, OAuth2/OIDC, SAML, WebSocket, DNS, mTLS), producing working PoCs and clear remediation guidance.\n\nReview cryptographic implementations - key management, TLS configuration, token signing/encryption, data-at-rest and in-transit protections - and catch misuse of crypto primitives.\n\nConduct secure code review (Go/Python) and threat modeling for new services and features; embed security gates into our GitLab CI/CD pipelines.\n\nBuild and operate AI-assisted security workflows - automating recon, triage, code analysis, and vulnerability detection to scale coverage across ~85 engineers' output.\n\nHarden our AWS/EKS environment: IAM, network segmentation, Kubernetes security posture, container and supply-chain security, secrets management.\n\nLead vulnerability management - prioritize, track, and verify remediation; reduce false positives and mean-time-to-fix.\n\nSupport compliance and regulatory needs (PCI DSS, BSP requirements, Data Privacy Act / NPC) with evidence, controls testing, and risk assessments.\n\nRespond to incidents: investigate, contain, perform root-cause analysis, and drive preventative fixes.\n\nMentor engineers and raise the organization's overall security maturity through guidance, tooling, and training.\n\nCore requirements\nExperience\n5+ years in offensive security, application security, or security engineering, with a strong hands-on penetration-testing background.\n\nDemonstrated track record of finding, exploiting, and responsibly reporting real vulnerabilities (CVEs, bug bounty, or documented engagements a plus).\n\nExperience securing cloud-native, microservices environments in production - ideally fintech, banking, or another regulated, high-trust domain.\n\nHands-on experience with security tooling\nYou should be fluent with the categories below and the leading tools in each (we don't expect every single tool, but we expect deep command of most categories):\nCategory\nRepresentative tools\nWeb app testing\nBurp Suite (Pro), OWASP ZAP, Nikto, sqlmap, Acunetix\nNetwork & vuln scanning\nNmap, Nessus, OpenVAS, Qualys, Nexpose, Masscan\nExploitation / red team\nMetasploit, Cobalt Strike, Sliver, Impacket, BloodHound\nMobile security\nMobSF, Frida, Objection, Drozer, apktool, jadx, Hopper, Corellium, Xcode/Android Studio\nReverse engineering\nGhidra, IDA Pro, radare2 / Cutter, Binary Ninja\nFuzzing\nAFL++, libFuzzer, boofuzz, Jazzer\nSAST / DAST / SCA\nSemgrep, SonarQube, Checkmarx, Fortify, Snyk, Bandit (Python), gosec (Go)\nCloud & Kubernetes security\nProwler, ScoutSuite, kube-bench, kube-hunter, Falco, Trivy, Checkov, tfsec/Terrascan\nContainer & supply chain\nTrivy, Grype, Clair, Anchore, Cosign / Sigstore\nSecrets scanning\nGitleaks, TruffleHog\nTraffic & protocol analysis\nWireshark, tcpdump, mitmproxy\nCredential attacks\nHashcat, John the Ripper, Hydra\nSIEM / detection\nSplunk, Elastic Security (ELK), Wazuh\nMobile application security testing\nProven experience testing Android and iOS apps end to end.\n\nStatic and dynamic analysis, runtime hooking/instrumentation (Frida/Objection), SSL/TLS pinning bypass, tamper and root/jailbreak-detection analysis.\n\nReverse engineering of APKs/IPAs; review of insecure local storage, hardcoded secrets, insecure IPC, and deep-link abuse.\n\nFamiliarity with the OWASP MASVS / MASTG mobile security standards.\n\nSecurity standards & frameworks\nOWASP - Top 10, ASVS, API Security Top 10, MASVS/MASTG, SAMM.\n\nPCI DSS (critical for our payment and lending flows).\n\nNIST - CSF, SP 800-53, SP 800-63 (digital identity).\n\nISO/IEC 27001 / 27002, CIS Controls & Benchmarks, SOC 2.\n\nAwareness of BSP regulatory expectations and the Philippine Data Privacy Act (RA 10173 / NPC).\n\nCryptography\nSolid, practical understanding of modern cryptography and, just as importantly, how it gets misused:\nSymmetric: AES (GCM, CBC, modes & IV/nonce pitfalls), ChaCha20-Poly1305.\n\nAsymmetric: RSA, ECC (ECDSA, EdDSA/Ed25519, ECDH).\n\nHashing & KDFs: SHA-2/3, HMAC, bcrypt, scrypt, Argon2, PBKDF2.\n\nKey exchange & PKI: Diffie-Hellman/ECDH, TLS 1.2/1.3, certificate lifecycle, mTLS.\n\nTokens: JWT/JWS/JWE - signing, encryption, and common vulnerabilities (alg confusion, weak keys, replay).\n\nKey management and secrets with AWS KMS / HSM.\n\nProtocol exploitation\nAbility to analyze and find exploitable flaws in network and application protocols: TCP/IP, TLS/SSL, HTTP/HTTPS, HTTP/2, gRPC, WebSocket, DNS, mTLS.\n\nAttacking authentication/authorization protocols - OAuth 2.0, OIDC, SAML (token theft, scope abuse, redirect and confusion attacks).\n\nAPI security testing across REST, GraphQL, and gRPC (IDOR/BOLA, mass assignment, injection, rate-limit and business-logic abuse).\n\nAI-driven security (advanced specialty)\nWe want someone who treats AI as a force multiplier for security work - not a buzzword. You should be able to demonstrate a concrete AI workflow for finding a security issue. For example:\nExample workflow we'd expect you to speak to (or demo live):\nIngest a target service's source (Go/Python) and OpenAPI/proto definitions.\n\nAgentic analysis - drive an LLM agent (e.g., via scripted tool-calling) to map data flows, identify untrusted inputs, and flag candidate vulnerability classes (injection, auth bypass, SSRF, IDOR).\n\nCorrelate LLM findings against SAST output (Semgrep/gosec/Bandit) to cut false positives and rank by exploitability.\n\nGenerate and validate a PoC - have the agent draft an exploit request, run it against a staging target, and confirm the issue dynamically.\n\nProduce a remediation diff and a human-readable report.\n\nAdditional AI-security expectations:\nUsing LLMs for code review, log/anomaly triage, and detection-rule generation.\n\nUnderstanding LLM/AI system security itself - prompt injection, data exfiltration, model/supply-chain risks (OWASP Top 10 for LLM Applications), relevant to our own AI features.\n\nProgramming\nStrong Python or Go skills - you build your own tooling, automate testing, and read/debug our production services. (Our stack is Go + Python, so you'll be reviewing real code, not just running scanners.)\n\nComfortable with Bash, Git/GitLab CI, Docker, and Kubernetes manifests.\n\nNice to have\nPrior experience in fintech, banking, or payments under PCI DSS.\n\nBug bounty track record or published research / CVEs.\n\nExperience with Kafka, ClickHouse, or event-driven architectures from a security standpoint.\n\nDetection engineering and threat hunting experience.\n\nInfrastructure-as-code security (Terraform) and cloud security automation.\n\nWhat success looks like (first 6 months)\nDelivered at least one full-scope pentest across our mobile + API surface with prioritized, remediated findings.\n\nSecurity gates integrated into CI/CD with measurably fewer false positives.\n\nA working AI-assisted triage/analysis workflow in use by the team.\n\nA clear, risk-ranked view of our top vulnerabilities and a tracked path to closing them.\n\nCompensation & benefits\nBase: up to ~USD 4,000 / month, negotiable based on experience and demonstrated skill.\n\nHybrid / remote-friendly setup.\n\nHealth coverage, learning & certification budget, conference/training support, and modern equipment.\n\nHigh-impact, high-autonomy role with direct visibility to engineering leadership.","description_format":"text","description_chars":8969,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Philippines","iso":"PH","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Job Boards & Aggregators"],"lifecycle":[{"event":"open","at":"2026-10-28T12:31:39Z"}],"visa":[],"liveness":{"score":38,"band":"fade","label":"Fading","p_open":1,"p_active":0.476,"p_room":0.788,"age_days":8,"expected_fill_days":10,"reasons":["conf:1","velocity","win:late"],"computed_at":"2026-11-06T05:58:05Z"},"pay":{"stated_usd_annual":48000,"is_top_pay":false},"html_url":"https://alion.io/job/kalibrr-senior-cybersecurity-specialist","json_url":"https://alion.io/job/kalibrr-senior-cybersecurity-specialist.json","meta":{"generated_at":"2026-11-06T11:41:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21281,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":50060},"rest":"https://alion.io/mcp/rest/get_company?id=50060"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkalibrr-senior-cybersecurity-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkalibrr-senior-cybersecurity-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkalibrr-senior-cybersecurity-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kalibrr-senior-cybersecurity-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkalibrr-senior-cybersecurity-specialist"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3396170}},{"tool":"search_jobs","arguments":{"company":"kalibrr.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3396170},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}