Cybersecurity Consultant (Offensive Security)

About the role

ITSEC Asia is seeking a Cybersecurity Consultant (Offensive Security) to join its Singapore team. The role focuses on conducting penetration testing and security assessments across a wide range of technology platforms, supporting high‑impact projects for government and critical‑infrastructure clients.

Key responsibilities

• Perform penetration testing and vulnerability assessments on web applications, APIs, mobile apps, networks, cloud environments and other platforms.
• Support security assessments for Operational Technology (OT), Internet of Things (IoT) and other specialised environments.
• Identify, validate and evaluate the technical and business impact of discovered vulnerabilities.
• Document testing activities, proof‑of‑concept results and assessment conclusions.
• Prepare professional penetration‑testing reports with findings, risk implications and remediation recommendations.
• Present technical findings to clients and explain remediation approaches to both technical and non‑technical stakeholders.
• Conduct remediation verification and retesting to ensure vulnerabilities are effectively addressed.
• Explore AI‑assisted testing, automation and scripting to improve testing and reporting workflows.

Required profile

• Singapore citizenship (mandatory due to project eligibility).
• Diploma or degree in Cybersecurity, Information Security, Computer Science, Engineering or a related discipline.
• Approximately 3 years of hands‑on penetration‑testing or offensive‑security experience (strong junior candidates are also considered).
• Relevant certifications such as CREST Registered Tester (CRT) or Offensive Security Certified Professional (OSCP) are preferred.
• Experience with security testing of web applications, APIs, networks, Active Directory, mobile or cloud environments.
• Strong analytical, problem‑solving and communication skills.

Required skills

• Penetration testing methodologies and tools.
• Web application and API security testing.
• Network and cloud security testing.
• Active Directory, mobile and OT/ICS/IoT security testing.
• Scripting and automation for security testing.
• AI‑assisted security testing techniques.
• CREST Registered Tester (CRT) certification.
• Offensive Security Certified Professional (OSCP) certification.