Penetration Test and Vulnerability Assessment Expert

About the role

Cyber Protection Group is looking for a Penetration Test and Vulnerability Assessment Expert to support its security work. The role is open to Singapore citizens only. You will test IT assets, write security assessment tools, report findings and help others fix the issues you find.

Key responsibilities

• Conduct comprehensive penetration testing, vulnerability assessments and source code security reviews on IT assets, including infrastructure, web applications and military applications.
• Develop tailored security assessment tools and scripts to improve testing capabilities and address evolving threats.
• Document findings, analyse them and prepare detailed technical reports, including executive summaries for different stakeholders.
• Work with security engineers, developers and others to give actionable guidance on fixing security risks.
• Advise on designing and implementing security controls across applications, infrastructure and networks.
• Deliver training and awareness programmes for SAF personnel, with opportunities for growth in leadership and knowledge sharing within the military cybersecurity context.
• Keep up to date with emerging threats, best practices and industry frameworks.

Required profile

• Education in information security, computer science, IT or a related field.
• Strong understanding of web application, infrastructure and network security architecture.
• Excellent communication skills, able to explain complex security findings to technical and non-technical audiences.
• Ability to work independently and in cross-functional teams; highly analytical and self-driven.
• Good to have: at least 2 years of cybersecurity experience, familiarity with common penetration testing tools and regulations, and a track record of identifying and disclosing vulnerabilities or recognition in CTF competitions.

Required skills

• Industry-recognised certifications such as CREST CRT, GPEN, etc.
• Proficiency in scripting languages such as Python, PowerShell, JavaScript, VBScript, Ruby or Perl.
• Proficiency with tools such as BurpSuite, Metasploit, Nexpose and Nessus.
• Experience assessing application infrastructure, networks and cloud-based systems is good to have.