ST Engineering is a global technology, defence and engineering group with offices across Asia, Europe, the Middle East and the U.S., serving customers in more than 100 countries. The Group uses technology and innovation to solve real-world problems and improve lives. Our dedication to excellence and our strong track record have earned us a distinctive reputation for quality and trust spanning across the aerospace, smart city, defence and public security segments. Headquartered in Singapore, ST Engineering ranks among the largest companies listed on the Singapore Exchange.
Join our Cyber Team
We are an industry leader in cybersecurity with over two decades of experience, we deliver a holistic suite of trusted cybersecurity solutions to empower cyber resilience for government and ministries, critical infrastructures, and commercial enterprises. Backed by our indigenous capabilities and deep domain expertise, we offer robust cyber-secure products and services in cryptography, cybersecurity engineering, digital authentication, SCADA protection, audit and compliance. We specialise in the design and build of security operations centres for cybersecurity professionals and provide managed security services to strengthen the cybersecurity posture of our government and enterprise customers.
We are seeking an experienced Cybersecurity Specialist to join our cybersecurity team. The successful candidate will conduct red teaming and penetration testing to identify security risks and weaknesses in our client systems and applications. The goal is to provide recommendations for remediation and improvement to overall security posture of our client systems and applications.
Responsibilities:
Preparation and Planning
- Working with the client to define the scope of the engagement, target systems, and authorized testing methods.
- Gathering information about the target systems through open-source intelligence (OSINT) techniques and network scanning to understand the target environment.
- Develop scripts to automate repetitive tasks and improve testing efficiency.
Conduct of Red Teaming and Penetration Testing
- Simulating social engineering attacks to assess the human element of security and identify weaknesses in security awareness training.
- Using vulnerability scanners to identify potential weaknesses in systems and applications.
- Leveraging their knowledge and tools to manually exploit discovered vulnerabilities or find new ones not identified by scanners. This may involve techniques like SQL injection, buffer overflows, or privilege escalation.
- Identify and report security vulnerabilities, weaknesses, and misconfigurations.
- Once a foothold is gained, testers may attempt to escalate privileges and move laterally within the network to assess the potential impact of an attack.
- Depending on the engagement scope, they may simulate further attacker actions like stealing data, deploying malware, or disrupting operations.
- Collaborate with internal IT and security teams to ensure testing is conducted safely and effectively. They may also brief stakeholders on their findings and recommendations.
Post-Testing and Documentation
- Documenting the entire testing process, discovered vulnerabilities, their potential impact, and recommendations for remediation in a clear and concise report.
- Support and advise remediation plans to address identified vulnerabilities and threats.
- Advise and collaborate with client IT team to implement recommendations to improve security posture of target system/network.
- Present findings and recommendations to management and stakeholders.
- Develop and maintain documentation of testing methodologies and results.
Requirements:
- At least 3 years of experience in host configuration review, web application penetration testing, vulnerability assessment and penetration testing, or related field. More experienced candidate could be considered to lead projects as well.
- In-depth understanding of major operating systems like Windows, Linux, and macOS. This includes knowledge of their security features and common vulnerabilities.
- Strong grasp of networking concepts like TCP/IP, firewalls, routing, and network protocols. Familiarity with various network security tools for scanning and vulnerability assessment is a plus.
- Deep understanding of different types of vulnerabilities in systems and applications. Knowledge of common exploits and how to leverage them ethically during penetration testing.
- Proficiency in scripting languages like Python, Bash, PowerShell, or Ruby is highly valuable. These languages can automate tasks and create custom tools for testing. Some roles might require knowledge of programming languages like Java or Golang for advanced testing purposes.
- Familiarity with a variety of penetration testing tools and frameworks like Metasploit, Nessus, OpenVAS, etc. These tools help automate tasks, identify vulnerabilities and manage the testing process.
- As cloud adoption grows, understanding cloud security concepts and potential vulnerabilities in cloud platforms like AWS, Azure, or GCP is becoming increasingly important.
- Knowledge of cryptography and encryption techniques.
- Familiarity with remote access technologies used by attackers.
- Understanding of security best practices and industry standards (e.g., NIST Cybersecurity Framework).
- Possess one (or more) of the following Cybersecurity certifications:
- GIAC Web Application Penetration Tester (GWAPT)
- GIAC Penetration Tester (GPEN)
- GIAC Mobile Device Security Analyst (GMOB)
- GIAC Cloud Penetration Tester (GCPN)
- GIAC Red Team Professional (GRTP)
- GIAC Assessing and Auditing Wireless Networks (GAWN)
- Offensive Security Certified Professional (OSCP)
- Offensive Security Exploit Developer (OSED)
- CREST Registered Penetration Tester (CRT)
- Ability to collaborate with team members, executive tasks effectively and independently
- Strong analytical and problem-solving skills
- Possess good communication, interpersonal and reporting skills
- Self-motivated to learn and stay up-to-date with emerging threats, vulnerabilities, and red-teaming & penetration testing techniques.
- Singaporeans only
- Work Location: Jurong East
Find out more: https://www.stengg.com/cybersecurity
ST Engineering believes in fostering a culture where team members are encouraged to overcome challenges, explore new ideas, and work together to succeed. We value individuals who are determined to push beyond the boundaries, and have a thirst for knowledge, continuous learning, and self-improvement.
