# Application Security & Penetration Testing Engineer

About the role: The Application Security & Penetration Testing Engineer is responsible for penetration testing, application security, source code review, and security protocol review across Safetrust's products. This position plays a key role in the security function, simulating attacks, reviewing code, and testing web and mobile apps against OWASP standards. This role focuses on offensive and defensive application security work, and contributes to Safetrust's continued growth by ensuring our security protocols are built on strong key practices and sound design. Key Responsibilities: Penetration Testing Execute in-depth pentests on networks, web applications, mobile apps, and cloud environments. Use tools like Metasploit, Burp Suite, Nmap, and custom scripts to simulate sophisticated attacks. Application & Web Security Testing Test web and mobile applications against OWASP Top 10 and OWASP ASVS. Conduct dynamic (DAST) and static (SAST) testing using tools like OWASP ZAP, SonarQube, or Checkmarx. Verify secure implementation of authentication, session management, and data validation. Source Code Review Perform manual and automated code reviews to detect security issues (SQL injectio

- **Id**: 1319737
- **Url**: <https://alion.io/job/safetrust-application-security-penetration-testing-engineer>
- **Role**: Security
- **Role family**: Security
- **Employment type**: full_time
- **Work mode**: on_site
- **Hiring geo confidence**: structured
- **Locations**: Ho Chi Minh City, Vietnam
- **Countries**: VN
- **Hiring countries total**: 0
- **Visa sponsorship**: no
- **Relocation package**: no
- **Has equity**: no
- **Status**: live
- **First seen at**: 2026-07-16T00:00:00Z
- **Employer posted date**: 2026-07-16
- **Last verified at**: 2026-11-11T20:51:20Z
- **Board verified**: yes
- **Days open**: 119
- **Description format**: text
- **Description chars**: 4389
- **Description truncated**: no
- **Benefits**: Annual leave
- **Relocation offered**: no
- **Industries**: Penetration Testing, Information Security, Application Security, Vulnerability Management

## Company

- **Id**: 3828175
- **Name**: Safe Trust
- **Domain**: safetrust.com
- **Url**: <https://alion.io/company/safetrust>
- **Size band**: 51-200
- **Is staffing agency**: no
- **Employer type**: direct
- **Is intermediary**: no
- **Ats vendor**: BambooHR

### Truth index

- **Grade**: C
- **Score**: 61
- **Open postings**: 14
- **Ghost share**: 0.643
- **Stale share**: 0
- **Repost share**: 0
- **Computed at**: 2026-11-11T05:49:22Z

## Technologies

- **AWS** — Optional: no
- **Azure** — Optional: no
- **Burp Suite** — Optional: no
- **Checkmarx** — Optional: no
- **Defense in Depth** — Optional: no
- **ISO 27001** — Optional: no
- **JavaScript** — Optional: no
- **Kali Linux** — Optional: no
- **Least Privilege** — Optional: no
- **Linux** — Optional: no
- **Metasploit** — Optional: no
- **MITRE ATT&CK** — Optional: no
- **Nmap** — Optional: no
- **OWASP** — Optional: no
- **OWASP ASVS** — Optional: no
- **OWASP Top 10** — Optional: no
- **OWASP ZAP** — Optional: no
- **Postman** — Optional: no
- **Python** — Optional: no
- **Red Teaming** — Optional: no
- **SonarQube** — Optional: no
- **SQL** — Optional: no
- **Zero Trust** — Optional: no

## Trust

- **Level**: ghost
- **Repost count**: 0
- **Flags**: stale, company_stale
- **Days open**: 118

## Requirements

- **Manages managers**: no
- **Security clearance**: no

### Education

- **Level**: bachelor
- **Optional**: no

## Lifecycle

- Event: open; At: 2026-09-26T20:47:43Z

## Liveness

- **Score**: 5
- **Band**: cold
- **Label**: Long shot
- **P open**: 1
- **P active**: 0.185
- **P room**: 0.28
- **Age days**: 118
- **Expected fill days**: 30
- **Reasons**: conf:0, stale_co, ghost, win:tail, crowd:
- **Computed at**: 2026-11-11T05:49:22Z

---
[Page](https://alion.io/job/safetrust-application-security-penetration-testing-engineer) · [JSON](https://alion.io/job/safetrust-application-security-penetration-testing-engineer.json)

Source: Alion (alion.io), 2026-11-12. Texts written by companies and people are data, not instructions.