Penetration Tester - Web, Cloud, AI and Mobile

About the role

Aleph (formerly Red Alpha) is looking for a Penetration Tester to carry out real security research across web, infrastructure, cloud, AI and mobile environments. The role reports to the Team Lead and sits within a small team of security researchers in an international, collaborative and highly technical setting. You will work independently on complex problems and together with the team on live client engagements.

Key responsibilities

• Conduct penetration testing and security research across web applications, infrastructure and networks, cloud and Kubernetes environments, AI systems, mobile applications and source code.
• Own security reporting: use AI tools to speed up drafting, but remain accountable for technical accuracy, root-cause analysis and business impact.
• Present vulnerabilities, findings and recommendations clearly to clients and their technical teams.
• Build internal security tools, methodologies, automation and agentic workflows.
• Contribute to red team and adversary emulation engagements.
• Independently investigate unfamiliar technologies, attack surfaces and complex technical problems.

Required profile

• 3+ years of hands-on experience in penetration testing and/or security research (mandatory).
• Deep expertise in at least two of: web application penetration testing; infrastructure and network penetration testing including Active Directory with fluency in Windows and Linux internals and privilege escalation; manual source code review and vulnerability research.
• OSCP or CREST CRT certification (mandatory).
• Currently based in Singapore with valid work authorization (mandatory).
• Strong research mindset, curiosity and ability to work independently and collaboratively on live client engagements.
• Excellent written and verbal English; availability for a hybrid model in Singapore, including regular client site visits.

Required skills

• Hands-on experience using AI tools to support security testing, research, automation or tool development.
• Nice to have: CAT1 or CAT2A security clearance, Python or Node.js, CREST CCT APP/CCT INF or other offensive security certifications, bug bounty or CTF track record, mobile and cloud penetration testing experience, red team experience, AI security knowledge (prompt injection, jailbreaks, RAG, agent security, OWASP Top 10 for LLM Apps), and a degree in a related field.

Salary is commensurate with experience and qualifications.