Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowFirst seen 29 hours ago

Cybersecurity Engineer

Plutus2121 open roles

Where
Karachi, Pakistan, Remote
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowCybersecurity EngineerPlutus21 · Karachi, Pakistan, Remote

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Plutus21's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.7% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.2%1 day
  2. 4.5%3 days
  3. 12.7%7 days
  4. 20.4%14 days
  5. 35.6%30 days
  6. 58.7%60 days
This job: first seen 29 hours ago

The posting

About the role

This is the one security engineer we can point at almost any engagement and trust to deliver. The work leans offensive: network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and LLM systems. It also carries the defensive and governance range to stand the function up from zero, because a one-person security team cannot only break things, it has to build the controls, write the policies, and pass the audits too.

You will operate across Plutus21 and its clients, so the same person who runs a red-team exercise one week documents SOC 2 evidence the next. We want depth in offense and competence across the rest. You set the foundations, you build the tooling and the processes, and you help hire the pod as the demand grows.

What you will do

Offensive security (primary)

  • Run full-scope penetration tests against networks, applications, APIs, and cloud environments, following a recognized method (PTES or equivalent), from scoping to retest.
  • Perform red-team and adversary-simulation exercises mapped to MITRE ATT&CK, chaining findings into realistic attack paths rather than reporting isolated vulnerabilities.
  • Conduct social-engineering and phishing assessments where the engagement authorizes them.
  • Deliver findings with proof-of-concept, business impact, a severity rating (CVSS), and remediation that an engineer can act on.

Web and PHP application attacks

  • Exploit and report the full OWASP Top 10 class of flaws: injection, broken access control, authentication and session weaknesses, SSRF, insecure deserialization, and the rest.
  • Carry deep, hands-on PHP application testing (Laravel, WordPress, and legacy custom stacks): source-assisted review, object-injection and deserialization chains, file-upload and LFI/RFI abuse, and common CMS and plugin weaknesses.
  • Test APIs (REST and GraphQL) and single-page front ends against current attack classes.

AI and LLM attacks

  • Red-team AI and LLM systems against the OWASP LLM Top 10: prompt injection (direct and indirect), jailbreaks, data and system-prompt exfiltration, insecure tool and plugin use, training-data and supply-chain risks, and model denial of service.
  • Test the agent and RAG systems Plutus21 builds for clients, including tool-call abuse and data-isolation failures.
  • Translate AI findings into guardrails and test cases engineering can adopt.

Application security in the pipeline

  • Embed secure development practice with engineering: threat modeling, secure code review, and security testing (SAST, DAST, dependency and secret scanning) wired into CI/CD.

Cloud, infrastructure, and identity

  • Design, deploy, and maintain security controls across cloud (AWS preferred), corporate infrastructure, endpoints, and identity.
  • Manage identity and access on a least-privilege basis, with MFA and periodic access reviews.
  • Stand up and run cloud security posture management.

Security operations and incident response

  • Monitor for threats and vulnerabilities, triage alerts, and lead detection, response, and post-incident review.
  • Select, deploy, and run the tooling: SIEM, EDR, vulnerability scanning, and CSPM.

Governance, risk, and compliance

  • Write and maintain security policies, standards, and procedures against recognized frameworks.
  • Drive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.
  • Assess the security posture of vendors and client environments, and return clear, prioritized remediation.

Client delivery and building the pod

  • Report risks, incidents, and metrics clearly to leadership and client stakeholders, and explain technical risk to non-technical audiences.
  • Deliver security awareness training to internal teams.
  • Define the structure, roadmap, and hiring plan for the security pod as it grows.

First 90 days

  • Run a first internal penetration test across Plutus21's own cloud, identity, and key applications, and return a prioritized remediation plan.
  • Stand up the core tooling baseline: vulnerability scanning, EDR, and a path to SIEM and CSPM.
  • Deliver one external client engagement end to end (pentest or AI red-team) with a client-ready report.
  • Publish the first version of the security policy set and the SOC 2 control map.

What we need

  • At least five years hands-on in cybersecurity, with real offensive depth (penetration testing or red-teaming as a core part of the work, not a side task).
  • A proven web application testing track record, including PHP-heavy stacks (Laravel, WordPress, or legacy custom code).
  • Command of the OWASP Top 10 and modern web and API attack classes, with the ability to show working exploits, not just scanner output.
  • Working knowledge of AI and LLM attack surface (prompt injection, jailbreaks, agent and RAG abuse), or the demonstrated ability to pick it up fast.
  • Strong working knowledge of at least one major cloud platform (AWS preferred) and its native security services.
  • Practical incident response, threat detection, and log analysis with SIEM and EDR.
  • Solid grounding in networking, operating systems, identity management, and encryption.
  • Scripting and automation in Python, Bash, or PowerShell.
  • Experience with at least one compliance framework: SOC 2, ISO 27001, or NIST CSF.
  • The temperament to own a function from the ground up: self-directed, able to prioritize under pressure, and comfortable being the only security person in the room for a while.
  • Excellent written and spoken English, with the ability to turn technical risk into plain language for non-technical stakeholders. The report is half the job.

Nice to have

  • Offensive certifications: OSCP (strongly preferred), OSWE, OSEP, or CRTP.
  • Broader credentials: CISSP, CEH, CompTIA Security+, or a recognized cloud security certification.
  • A public track record: bug bounty results, CVEs, published research, or a tool or write-up portfolio.
  • Burp Suite Professional fluency and custom tooling or extension development.
  • Hands-on AI red-teaming experience against production LLM or agent systems.
  • Exposure across more than one cloud, and experience in a consulting or multi-client delivery setting.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Plutus21's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Plutus21's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Plutus21's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.