Your application and all hiring communication for this role run through the Techy Recruiter team.

About Ajaib

Ajaib is an Indonesian investment platform helping people access and manage investments across stocks, crypto, and U.S. stocks. As the platform continues to grow, protecting our customers, products, and technology is fundamental to maintaining trust.

We’re looking for an Offensive Security Lead to identify weaknesses before attackers do and help strengthen security across our applications, infrastructure, cloud environments, and internal systems.

The role

You’ll lead Ajaib’s offensive security programme and take a hands-on role in testing the resilience of our technology.

You’ll design and execute penetration tests, red-team exercises, adversary simulations, and security assessments across mobile applications, APIs, backend services, cloud infrastructure, and corporate environments.

You’ll work closely with application security, engineering, infrastructure, incident response, and risk teams to turn findings into meaningful improvements. This role requires strong technical depth, sound judgement, and the ability to communicate complex attack paths clearly to both technical teams and senior leaders.

What you’ll do

Define and lead Ajaib’s offensive security strategy, roadmap, and testing programme

Conduct hands-on penetration testing across mobile applications, web applications, APIs, backend services, cloud environments, and internal systems

Plan and execute red-team exercises and adversary simulations based on realistic threat scenarios

Identify complex attack paths across applications, infrastructure, identity systems, and third-party integrations

Test authentication, authorisation, session management, account recovery, transaction flows, and customer-protection controls

Perform security assessments of new products, features, architectures, and high-risk integrations

Evaluate the effectiveness of security controls, monitoring, detection, and incident-response capabilities

Partner with engineering and security teams to validate remediation and confirm that vulnerabilities are fully resolved

Provide clear, practical remediation guidance that helps teams reduce risk without slowing delivery

Develop custom testing tools, scripts, payloads, and automation to improve offensive-security coverage

Coordinate external penetration tests, specialist assessments, and independent security reviews

Support responsible-disclosure and bug-bounty activities, including triage, validation, and remediation tracking

Create high-quality reports that explain technical findings, business impact, attack scenarios, and recommended actions

Define offensive-security metrics, testing standards, and risk-prioritisation methods

Mentor offensive-security engineers and help grow the team’s technical capability

Share attack trends, lessons learned, and defensive recommendations with security and engineering teams

Stay current with emerging vulnerabilities, attacker techniques, exploitation methods, and threats affecting financial platforms

What you bring

Strong experience in penetration testing, red teaming, offensive security, or security research

Experience leading offensive-security engagements or mentoring security professionals

Deep technical knowledge of web, mobile, API, cloud, infrastructure, and identity security

Hands-on experience identifying and exploiting complex vulnerabilities and chained attack paths

Strong understanding of common application and infrastructure weaknesses, including the OWASP Top 10 and OWASP API Security Top 10

Experience testing authentication, authorisation, access control, cryptography, transaction flows, and business logic

Strong knowledge of network protocols, operating systems, cloud environments, containers, and modern application architectures

Experience with manual testing techniques as well as offensive-security tools and frameworks

Ability to write scripts or tools in languages such as Python, Go, JavaScript, or Bash

Experience producing clear technical reports and presenting risk to engineering leaders and senior stakeholders