About The Role:
Execute and lead offensive security initiatives including penetration testing, vulnerability assessments, and security evaluations to ensure the resilience of DOKU's systems, applications, and infrastructure. Provide technical expertise and actionable recommendations to strengthen cybersecurity posture and regulatory compliance.
What Will You Do:
- Plan and execute periodic internal Pentest & VA activities
- Review governance documents for security testing
- Conduct AppSec testing across Web/Mobile/API
- Perform penetration testing on systems and infrastructure
- Run periodic vulnerability scans on all digital assets
- Develop detailed Pentest & VA reports
- Provide consolidated weekly/monthly reporting
- Offer technical security advisory to IT teams
- Coordinate improvement actions from internal & external security findings
- Support PCI DSS, ISO 27001, and Bank Indonesia compliance testing
- Maintain updated knowledge of threat landscape
- Ensure effective documentation and evidence management
- Supervise team workload and technical execution
What we are looking for:
- Bachelor's degree in Computer Science, Information Security, Engineering, or related field
- Minimum 4–6 years in cybersecurity offensive roles such as Pentester, AppSec Engineer, or VAPT Specialist
- Experience with the following penetration tools: Kali Linux, Metasploit, Nessus, Qualys, Burp Suite, Acunetix, MobSF
- Understanding of exploitation technologies and techniques, as well as reverse engineering
- Strong knowledge of IT security principles, data encryption, and data privacy laws.
- Knowledge of security technologies such as firewalls, IDS/IPS systems, SIEM, and encryption tools.
- Minimum of a CEH, WAPT, MAPT or equivalent diploma
- Experience conducting penetration tests, bug hunting, and CTFs
- Proficient in Python, Java, PHP, Kotlin, and Swift programming language.
Soft Skill Requirements:
- Leadership and supervision capability
- Analytical and structured problem solving
- High attention to detail and documentation discipline
- Effective communication across technical and non-technical teams
- Pressure resilience and proactive mindset
Technical Skill Requirements:
- Advanced penetration testing (Web, Mobile, API, Infra)
- Vulnerability assessment and exploit development
- Secure coding principles and AppSec methodologies
- PCI DSS, ASV, IVA, ISO 27001 compliance awareness
- Familiarity with DevSecOps tooling and automation
- Strong reporting and remediation advisory skill.
