Key Responsibilities
- Lead and conduct penetration testing, red teaming, and adversary simulation activities across web, mobile, infrastructure, cloud, OT, and telecommunications environments.
- Execute realistic attack scenarios to assess the resilience of Critical Information Infrastructure (CII), including systems supporting essential services.
- Support purple-teaming activities by translating offensive techniques into actionable detection and response improvements.
- Lead engagements end-to-end, including planning, execution, reporting, and technical debriefs with stakeholders.
- Mentor junior consultants and contribute to raising the team's overall technical standard.
- Drive continuous improvement of ASG's testing methodologies, tooling, and research, including taking on problem spaces outside your primary domain when required.
- And because this is government, be prepared to occasionally switch gears by contributing to strategic initiatives, supporting and executing procurement activities, participating in industry outreach, or undertaking coordination work, all of which ultimately help us strengthen security outcomes and make Singapore a safer place to live and work.
Required Skills & Experience
- An attacker's mindset with strong technical understanding of operating systems, networks, and modern enterprise environments.
- Proven ability to identify and execute real-world attack scenarios, beyond automated or checklist-based testing.
- Experience in penetration testing and/or red team operations, with exposure to adversary tradecraft and attack chaining.
- Demonstrated adaptability to transfer skills across technical domains (e.g. web to mobile, IT to OT, on-prem to cloud).
- Strong technical writing skills and the ability to clearly articulate security risks and impact.
- Typically 5-8 years of relevant experience in penetration testing, red team operations, or related offensive security roles, with demonstrated depth in hands-on technical work.
- Relevant industry certifications such as OSCP, CREST (e.g. CRT, CCT), CRTO, or equivalent are desirable. That said, we recognise that certifications alone do not define capability. Hands-on experience, problem-solving ability, and technical depth matter more to us than badges.
