Senior Offensive Security Engineer (Penetration Testing)

Job opportunity for Senior Offensive Security Engineer (Penetration Testing) at SMARTM2M Indonesia in KOTA BANDUNG, JAWA BARAT, Indonesia.

Qualification:

Responsibilities

Plan, scope, and execute penetration tests following NIST SP 800-115 with formal authorization, Rules of Engagement, execution logs, and structured reporting plus retesting.

Conduct web and API testing aligned to the OWASP Web Security Testing Guide with traceable test cases and coverage mapping for application and authentication/authorization flows.

Structure engagements per PTES phases for consistency across pre-engagement, intelligence gathering, exploitation, post-exploitation, and reporting.

Map techniques and findings to MITRE ATT&CK to support SOC/DFIR integration and detection engineering backlogs.

Produce PCI-ready deliverables, including Rules of Engagement, segmentation testing where applicable, and evidence artifacts suitable for assessors.

Write clear, prioritized remediation guidance with verification steps and retest results suitable for audits and leadership briefings.

Collaborate with engineering and security stakeholders to align test scope with risk priorities and SDLC timing, leveraging OWASP guidance for application contexts.

Minimum qualifications

Demonstrated delivery of end-to-end penetration tests under NIST SP 800-115 and OWASP WSTG, including reporting and retesting workflows.

One or more of the following certifications as a minimum: CEH, PNPT, CRTO, CRTP, or CPTS (or equivalent practical credential) to evidence hands-on capability across pentest or adversary tradecraft.

Familiarity with PTES for engagement structure and with MITRE ATT&CK for technique mapping and narrative clarity.

Ability to produce auditable artifacts suitable for PCI-aligned programs when required by clients.

Preferred qualifications

OSCP as the primary preferred credential for rigorous, hands-on penetration testing capability recognized by employers globally.

Additional plus: GPEN or CREST CRT for methodology depth and external assurance signaling in regulated environments.

Experience translating ATT&CK-mapped findings into detection use-cases and engineering backlogs with stakeholders.