{"id":3342767,"url":"https://alion.io/job/plutus21-cybersecurity-engineer","title":"Cybersecurity Engineer","company":{"id":4421054,"name":"Plutus21","domain":"plutus21.com","url":"https://alion.io/company/plutus21","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Manatal","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Karachi, Pakistan"],"countries":["PK"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":18000,"max_usd":42000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"GraphQL","optional":false},{"name":"ISO 27001","optional":false},{"name":"Laravel","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PHP","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"WordPress","optional":false},{"name":"Burp Suite","optional":true}],"status":"live","first_seen_at":"2026-10-27T16:09:21Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-10-31T04:29:21Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About the role\nThis is the one security engineer we can point at almost any engagement and trust to deliver. The work leans offensive: network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and LLM systems. It also carries the defensive and governance range to stand the function up from zero, because a one-person security team cannot only break things, it has to build the controls, write the policies, and pass the audits too.\nYou will operate across Plutus21 and its clients, so the same person who runs a red-team exercise one week documents SOC 2 evidence the next. We want depth in offense and competence across the rest. You set the foundations, you build the tooling and the processes, and you help hire the pod as the demand grows.\nWhat you will do\nOffensive security (primary)\nRun full-scope penetration tests against networks, applications, APIs, and cloud environments, following a recognized method (PTES or equivalent), from scoping to retest.\n\nPerform red-team and adversary-simulation exercises mapped to MITRE ATT&CK, chaining findings into realistic attack paths rather than reporting isolated vulnerabilities.\n\nConduct social-engineering and phishing assessments where the engagement authorizes them.\n\nDeliver findings with proof-of-concept, business impact, a severity rating (CVSS), and remediation that an engineer can act on.\n\nWeb and PHP application attacks\nExploit and report the full OWASP Top 10 class of flaws: injection, broken access control, authentication and session weaknesses, SSRF, insecure deserialization, and the rest.\n\nCarry deep, hands-on PHP application testing (Laravel, WordPress, and legacy custom stacks): source-assisted review, object-injection and deserialization chains, file-upload and LFI/RFI abuse, and common CMS and plugin weaknesses.\n\nTest APIs (REST and GraphQL) and single-page front ends against current attack classes.\n\nAI and LLM attacks\nRed-team AI and LLM systems against the OWASP LLM Top 10: prompt injection (direct and indirect), jailbreaks, data and system-prompt exfiltration, insecure tool and plugin use, training-data and supply-chain risks, and model denial of service.\n\nTest the agent and RAG systems Plutus21 builds for clients, including tool-call abuse and data-isolation failures.\n\nTranslate AI findings into guardrails and test cases engineering can adopt.\n\nApplication security in the pipeline\nEmbed secure development practice with engineering: threat modeling, secure code review, and security testing (SAST, DAST, dependency and secret scanning) wired into CI/CD.\n\nCloud, infrastructure, and identity\nDesign, deploy, and maintain security controls across cloud (AWS preferred), corporate infrastructure, endpoints, and identity.\n\nManage identity and access on a least-privilege basis, with MFA and periodic access reviews.\n\nStand up and run cloud security posture management.\n\nSecurity operations and incident response\nMonitor for threats and vulnerabilities, triage alerts, and lead detection, response, and post-incident review.\n\nSelect, deploy, and run the tooling: SIEM, EDR, vulnerability scanning, and CSPM.\n\nGovernance, risk, and compliance\nWrite and maintain security policies, standards, and procedures against recognized frameworks.\n\nDrive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.\n\nAssess the security posture of vendors and client environments, and return clear, prioritized remediation.\n\nClient delivery and building the pod\nReport risks, incidents, and metrics clearly to leadership and client stakeholders, and explain technical risk to non-technical audiences.\n\nDeliver security awareness training to internal teams.\n\nDefine the structure, roadmap, and hiring plan for the security pod as it grows.\n\nFirst 90 days\nRun a first internal penetration test across Plutus21's own cloud, identity, and key applications, and return a prioritized remediation plan.\n\nStand up the core tooling baseline: vulnerability scanning, EDR, and a path to SIEM and CSPM.\n\nDeliver one external client engagement end to end (pentest or AI red-team) with a client-ready report.\n\nPublish the first version of the security policy set and the SOC 2 control map.\n\nWhat we need\nAt least five years hands-on in cybersecurity, with real offensive depth (penetration testing or red-teaming as a core part of the work, not a side task).\n\nA proven web application testing track record, including PHP-heavy stacks (Laravel, WordPress, or legacy custom code).\n\nCommand of the OWASP Top 10 and modern web and API attack classes, with the ability to show working exploits, not just scanner output.\n\nWorking knowledge of AI and LLM attack surface (prompt injection, jailbreaks, agent and RAG abuse), or the demonstrated ability to pick it up fast.\n\nStrong working knowledge of at least one major cloud platform (AWS preferred) and its native security services.\n\nPractical incident response, threat detection, and log analysis with SIEM and EDR.\n\nSolid grounding in networking, operating systems, identity management, and encryption.\n\nScripting and automation in Python, Bash, or PowerShell.\n\nExperience with at least one compliance framework: SOC 2, ISO 27001, or NIST CSF.\n\nThe temperament to own a function from the ground up: self-directed, able to prioritize under pressure, and comfortable being the only security person in the room for a while.\n\nExcellent written and spoken English, with the ability to turn technical risk into plain language for non-technical stakeholders. The report is half the job.\n\nNice to have\nOffensive certifications: OSCP (strongly preferred), OSWE, OSEP, or CRTP.\n\nBroader credentials: CISSP, CEH, CompTIA Security+, or a recognized cloud security certification.\n\nA public track record: bug bounty results, CVEs, published research, or a tool or write-up portfolio.\n\nBurp Suite Professional fluency and custom tooling or extension development.\n\nHands-on AI red-teaming experience against production LLM or agent systems.\n\nExposure across more than one cloud, and experience in a consulting or multi-client delivery setting.","description_format":"text","description_chars":6153,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-27T16:09:21Z"}],"visa":[],"liveness":{"score":84,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.888,"p_room":0.945,"age_days":2,"expected_fill_days":6,"reasons":["conf:3","velocity","win:mid"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/plutus21-cybersecurity-engineer","json_url":"https://alion.io/job/plutus21-cybersecurity-engineer.json","meta":{"generated_at":"2026-10-31T04:57:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6964,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4421054},"rest":"https://alion.io/mcp/rest/get_company?id=4421054"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fplutus21-cybersecurity-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fplutus21-cybersecurity-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fplutus21-cybersecurity-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/plutus21-cybersecurity-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fplutus21-cybersecurity-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3342767}},{"tool":"search_jobs","arguments":{"company":"plutus21.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3342767},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}