Middle/Senior Pen-Test Engineer

Middle/Senior Pen-Test Engineer

LOCATION: Hanoi/HCMC

JOB DESCRIPTION 

We are seeking an experienced Middle/Senior Pen-Test Engineer to identify and assess security vulnerabilities across our digital banking platform, including web and mobile applications, APIs, backend services, and cloud infrastructure. In this role, you will conduct penetration testing, evaluate banking-specific business logic, collaborate with engineering teams to remediate security issues, and strengthen the platform’s overall security posture in compliance with industry standards and regulatory requirements.

  • Plan and execute penetration tests across our web applications, mobile apps, APIs, backend services, cloud infrastructure and internal networks
  • Test authentication, authorization and session management flows, including digital onboarding, eKYC, transaction authorization and multi-factor journeys
  • Assess business logic vulnerabilities specific to banking products: account opening, deposits, lending, card issuance, limits, fees and rewards
  • Write clear, reproducible reports with proof of concept, realistic risk ratings and practical remediation guidance
  • Work directly with engineering teams to validate fixes and help them understand the root cause, not just the symptom
  • Contribute to threat modelling and secure design reviews for new features and integrations
  • Perform secure code reviews and help improve SAST, DAST, SCA and secret scanning coverage in our CI/CD pipelines
  • Support client-led and third-party penetration tests, respond to findings, and prepare evidence for client security assessments and regulatory reviews
  • Build internal tooling, test harnesses and attack playbooks to make testing repeatable
  • Track emerging threats relevant to digital banking and translate them into new test cases
  • Contribute to red team exercises and purple team collaboration with the detection and response side

REQUIRED SKILLS AND EXPERIENCE 

  • 3+ years of hands-on penetration testing or offensive security experience
  • Strong track record testing web applications and APIs (REST, GraphQL, gRPC) against OWASP Top 10 and beyond
  • Mobile application security testing experience on iOS and Android, including reverse engineering, runtime manipulation and bypassing client-side controls
  • Cloud security testing experience (AWS, Azure or GCP): IAM misconfiguration, privilege escalation paths, exposed services, container and Kubernetes security
  • Solid understanding of network protocols, TLS, and internal network attack techniques
  • Proficiency with tools such as Burp Suite, Nmap, Metasploit, Frida, Objection, MobSF, BloodHound, Nuclei and similar
  • Scripting ability in Python, Go, Bash or similar to build custom exploits and automation
  • Ability to read code and identify vulnerabilities at the source level (Java, Kotlin, Go, TypeScript, Swift or similar)
  • Excellent report writing and the ability to explain risk to both engineers and non-technical stakeholders
  • Strong ethics, discretion and judgement when handling sensitive findings and production systems

Nice to have

  • Experience testing banking, payments or fintech systems
  • Familiarity with OWASP ASVS, MASVS, SAMM, MITRE ATT&CK and PTES
  • Knowledge of regulatory and compliance frameworks such as MAS TRM Guidelines, PCI DSS, ISO 27001, SOC 2, or central bank security requirements in APAC and the Middle East
  • Experience with payment and card security: HSMs, key management, 3-D Secure, tokenisation, card processor integrations
  • Red team, adversary simulation or social engineering experience
  • Detection engineering or DFIR exposure
  • Published CVEs, bug bounty track record, CTF results, security research or conference talks
  • Certifications such as OSCP, OSWE, OSEP, OSCE, CREST CRT or CCT, GPEN, GWAPT, GMOB, or CISSP

BENEFITS 

  • Salary: Up to negotiation 
  • Probation salary is 100% of official salary 
  • 13th-month salary and performance review twice a year 
  • Bonus for special occasions each year (Labor Day, National Day, Solar New year, Lunar New Year) 
  • Project bonus 
  • Employee’s professional certification and training allowances subject to company regulations 
  • Health Care Insurance  
  • Annual Health Assessment 
  • Social, health and unemployment insurance following government policy 
  • Enjoy company summer trips and other team building activities held monthly and quarterly 
  • Professional, creative and dynamic working environment  
  • Work five days per week with flexible check-in time 

CONTACT