Offensive Security Engineer

About the role

Metrobank is seeking an Offensive Security Engineer to lead penetration testing, ethical hacking, and red‑team exercises across its network, web, mobile and critical systems. The role focuses on identifying vulnerabilities, simulating real‑world attacks and strengthening the bank’s cybersecurity posture.

Key responsibilities

• Plan, develop and execute penetration testing engagements, red‑team exercises and security assessments for networks, systems, web and mobile applications, and wireless environments.
• Conduct threat analysis, simulate attack scenarios including social engineering and physical security assessments.
• Identify vulnerabilities, attack paths and security weaknesses using manual and automated techniques.
• Assess effectiveness of firewalls, IDS/IPS and other defensive technologies.
• Develop testing methodologies, abuse cases and custom scripts or tools.
• Document findings, prepare technical and executive reports and communicate remediation recommendations.
• Partner with IT and development teams to validate fixes and drive timely remediation.
• Review security configurations, policies and procedures and provide improvement recommendations.
• Support cybersecurity investigations and risk assessments as needed.

Required profile

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity or related field.
• Hands‑on experience in penetration testing and ethical hacking.
• Strong understanding of security vulnerabilities, attack techniques and the attacker mindset.
• Knowledge of OWASP Top 10 application security risks.
• Relevant certifications such as OSCP, GPEN, GWAP, CEH are a plus.
• Technical background in networking, digital forensics, reverse engineering, web applications, databases and wireless technologies.
• Proficiency in scripting and programming for security testing and automation.
• Excellent communication skills and ability to work independently and in teams.

Required skills

• Penetration testing
• Ethical hacking
• Red‑team operations
• OWASP Top 10 knowledge
• Networking security
• Digital forensics
• Reverse engineering
• Web application security
• Database security
• Wireless security
• Scripting (e.g., Python, Bash)
• Security automation programming