Penetration Tester (VAPT, CREST CRT)

About the role

This full-time, on-site position is based in Singapore and focuses on performing penetration testing across web, mobile and infrastructure environments. The successful candidate will plan, execute and report on security assessments to uncover vulnerabilities and validate controls.

Key responsibilities

• Scope and plan VAPT engagements for web, mobile and infrastructure targets.
• Conduct manual and automated penetration tests, identifying security weaknesses.
• Document findings and produce clear, actionable reports for technical and non-technical stakeholders.
• Collaborate with security engineers, developers and business teams to recommend remediation and support retesting.
• Participate in red-team exercises and stay updated on emerging threats and attack techniques.
• Contribute to the improvement of testing methodologies, tools and processes.

Required profile

• Valid CREST Registered Tester (CRT) certification (not expired).
• Additional certifications such as OSCP, OSCE, GXPN, CISSP are a plus.
• Experience in penetration testing of web, mobile and infrastructure environments.
• Ability to work on-site in Singapore and attend face-to-face meetings.

Required skills

• Manual and automated vulnerability assessment techniques.
• Familiarity with penetration testing tools (e.g., Burp Suite, Metasploit, Nmap).
• Understanding of web, mobile and network security concepts.
• Report writing and communication of technical findings.

What we offer

• Competitive monthly salary ranging from SGD 6,000 to SGD 9,000.
• Permanent employment with opportunities for professional development.