Offensive Security Expert Engineer (Red Team)

About the role

The Red Team within Information Security at Sea Group simulates real-world adversaries to find vulnerabilities across its infrastructure, applications and people, including Shopee, SeaMoney (Monee) and Digibank. It runs end-to-end offensive operations, from external compromise and social engineering to internal lateral movement, and works closely with defensive teams to turn findings into detections and hardening. The role sits in the Red Team and focuses on offensive security research, purple-team collaboration and improving the team's methodology.

Key responsibilities

• Perform offensive security research: discover vulnerabilities, develop exploits, build and adapt post-exploitation tooling and red team infrastructure.
• Map attack paths and findings to MITRE ATT&CK, write technical reports and work with defenders to turn TTPs into detection rules and hardening, validated by retesting.
• Help codify standardized attack workflows, automation and a TTP library to make operations more efficient and repeatable.

Required profile

• Bachelor's degree in Computer Science or a related field.
• At least 5 years of security engineering experience.
• Hands-on social engineering and phishing, including campaign design, phishing infrastructure, payload delivery and identity theft.
• Active Directory expertise, including Kerberos attacks, ACL/ADCS abuse and cross-domain lateral movement.
• Ability to evade mainstream EDR and detection during engagements.
• Preferred: bug bounty awards, CVEs, security conference speaking, and experience with kill chains in ATT&CK.

Required skills

• Deep expertise in at least two of: operating systems, cloud native (containers / Kubernetes), IoT, and mobile (Android / iOS).
• Independent vulnerability discovery, root-cause analysis and exploit development.
• Building or adapting exploitation tools and automation in Python, Go or C.
• Familiarity with LLM application weaknesses (prompt injection, broken authorization, data leakage); prior research is a plus.