8790 Project Lead

**MUST HAVE**:
**Required Qualifications and Skills:

-     Experience:

-     Demonstrated leadership experience in managing complex security assessment projects.
-     Certifications (strongly preferred): OSCP, OSWE, OSEP, GXPN, GPEN, GWAPT, or equivalent advanced certifications.
-     Additional credentials (e.g., CISSP, AWS Security Specialty, Azure Security Engineer) are a plus.
-     Technical Skills:

-     Deep knowledge of web, mobile, and infrastructure attack surfaces.
-     Advanced hands-on experience with tools such as Burp Suite Pro, Metasploit, Cobalt Strike (if permitted), Wireshark, MobSF, Nessus, Qualys, firewall analysis tools (AlgoSec, Tufin).
-     Strong understanding of Active Directory attack vectors, cloud security (AWS, Azure), and firewall rule base analysis.
-     Soft Skills:

-     Exceptional communication skills; able to engage confidently with both technical and non-technical stakeholders.
-     Strong project coordination and time management abilities.
-     Mentorship and team development mindset; leads by example.
-     High attention to detail, precision in reporting, and quality-driven.
-     Other Requirements:

-     Willingness to provide onsite leadership presence in Malaysia as needed.
-     Comfortable interfacing with client CISO, cybersecurity, IT operations, and internal/external auditors.

**Requirements**:
**1. Project Lead**
-     Oversees all engagement streams (web, mobile, infra, AD, WiFi, cloud, firewall).
-     Acts as project lead and onsite escalation point.
-     Reviews reporting outputs, validates methodologies.
-     Interfaces with client's cybersecurity and management teams.

Key Responsibilities:
Engagement Leadership & Project Oversight
-     Lead and manage end-to-end penetration testing engagements, ensuring alignment with project scope, timeline, and contractual commitments.
-     Coordinate internal team activities, assign tasks, monitor progress, and ensure adherence to SLAs and milestones.
-     Serve as the primary technical interface for client stakeholders (e.g., cybersecurity leadership, system owners, developers).
-     Participate in and prepare for CAB (Change Advisory Board) meetings, change management approvals, and project status updates.

Technical Execution & Guidance
-     Provide expert-level hands-on testing and advisory across:

-     Application penetration testing (OWASP Top 10, business logic flaws).
-     Mobile app assessments (Android, iOS, Harmony).
-     Infrastructure assessments (routers, switches, firewalls, VPN, cloud).
-     AD penetration testing, lateral movement, privilege escalation.
-     WiFi network security testing.
-     Oversee and validate methodologies, ensuring that manual testing complements automated tools and scanners.
-     Review and approve complex exploit attempts, ensuring safety and non-disruption.

Quality Assurance & Reporting Oversight
-     Conduct in-depth technical reviews of all assessment reports before submission to the client.
-     Ensure zero false positives, accurate risk ratings, clear remediation recommendations, and properly documented attack sequences (including screenshots).
-     Oversee confirmatory retesting activities and final vulnerability closure validation.

Team Leadership & Mentoring
-     Mentor and develop mid-level penetration testers; provide feedback, share knowledge, and elevate technical capability within the team.
-     Establish best practices, internal playbooks, and reusable test approaches to improve engagement consistency.

Client Engagement & Communication
-     Support the client during internal and external audits by explaining findings, methodologies, and remediation strategies.
-     Deliver executive summaries and technical presentations as needed.

⸻

Required Qualifications and Skills:

-     Experience:

-     Demonstrated leadership experience in managing complex security assessment projects.
-     Certifications (strongly preferred): OSCP, OSWE, OSEP, GXPN, GPEN, GWAPT, or equivalent advanced certifications.
-     Additional credentials (e.g., CISSP, AWS Security Specialty, Azure Security Engineer) are a plus.
-     Technical Skills:

-     Deep knowledge of web, mobile, and infrastructure attack surfaces.
-     Advanced hands-on experience with tools such as Burp Suite Pro, Metasploit, Cobalt Strike (if permitted), Wireshark, MobSF, Nessus, Qualys, firewall analysis tools (AlgoSec, Tufin).
-     Strong understanding of Active Directory attack vectors, cloud security (AWS, Azure), and firewall rule base analysis.
-     Soft Skills:

-     Exceptional communication skills; able to engage confidently with both technical and non-technical stakeholders.
-     Strong project coordination and time management abilities.
-     Mentorship and team development mindset; leads by example.
-     High attention to detail, precision in reporting, and quality-driven.
-     Other Requirements:

-     Willingness to provide onsite leadership presence in