Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 125 days ago

VAPT Engineer

rytbank92 open roles

Where
Kuala Lumpur
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowVAPT Engineerrytbank · Kuala Lumpur

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on rytbank's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. rytbank postings stay open a median of 19 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 125 days ago

rytbank median: 19 days open

The posting

About the Team

We're building the next generation of digital banking infrastructure that combines enterprise-grade reliability with startup agility.

Our Cyber Security team is the backbone of our technology organisation, ensuring that innovation and trust go hand in hand as we scale Malaysia's first AI-powered digital bank.

You'll collaborate with some of the sharpest minds in the industry, operating in a supportive and dynamic environment that fosters creativity, exploration, and innovation.

Your next thrilling adventure starts here. Be part of shaping the future of digital banking today!

About the Role

VAPT Engineers sit within the 2nd-line CISO organisation at Ryt Bank, providing independent penetration testing and vulnerability assessment capability that is structurally separate from the 1st-line security function.

This role is for security professionals who are genuinely passionate about offensive security — finding vulnerabilities before adversaries do and helping Ryt Bank understand its real attack surface as an AI-powered digital bank.

What You'll Do

PENETRATION TESTING & VAPT

  • Plan and execute quarterly vulnerability assessments across the bank's full infrastructure, applications, and API surface. Sr VAPT Engineers own and lead the programme; VAPT Engineers execute assessments and triage findings.
  • Coordinate the annual intelligence-led penetration test covering internal network, external perimeter, applications, and APIs. Sr VAPT Engineers scope, manage, and validate; VAPT Engineers support execution.
  • Lead the bank's triennial red team simulation — intelligence-led, adversary-simulated exercises targeting critical banking systems. Sr VAPT Engineers lead; VAPT Engineers participate and develop skills.
  • Manage the external penetration testing firm relationship — scoping, reviewing methodologies, validating findings, and ensuring remediation is tracked. Led by Sr VAPT Engineers.

AI RED TEAM

  • Own the bank's AI red-team programme, testing the bank’s adopted large language models, RAG pipelines, MCP-connected agents, and agentic workflows.
  • Apply MITRE ATLAS (v5.4.0) techniques to simulate AI-targeted attacks: model API reconnaissance, training data poisoning, model evasion, prompt injection, indirect prompt injection via RAG documents, and confused-deputy attacks in agent-to-agent workflows.
  • Test against OWASP Mobile, API, Web and LLM Top 10 (2025 edition) — covering prompt injection, sensitive information disclosure, excessive agency, system prompt leakage, vector and embedding weaknesses, and AI supply chain risks.
  • Use AI red-team tooling to run systematic adversarial evaluations of the bank's AI systems. Sr VAPT Engineers own the programme; VAPT Engineers execute specific test scenarios.
  • Produce AI security findings reports and coordinate remediation with the Lead, Security Engineering.

REMEDIATION & REPORTING

  • Run purple team exercises in collaboration with the Lead, Cyber Operations — testing detection coverage, validating SIEM rules, and improving SOC response playbooks.
  • Produce clear, actionable pentest and AI red-team reports for technical and non-technical audiences — including executive summaries for the CISO and board.
  • Track all findings to remediation within agreed SLAs; escalate unresolved critical findings through the CISO.
  • Provide technical security consultancy to engineering teams on high-risk features, novel architectures, and AI system deployments.

What We're Seeking

EXPERIENCE

  • 3–7 years in penetration testing, red teaming, or offensive security roles with demonstrated independent delivery.
  • Proven experience scoping, leading, and reporting on mobile and web applications, API, network, and cloud penetration tests.
  • Hands-on experience with mobile, API and web application penetration testing
  • Deep familiarity with AI penetration testing and tooling — testing LLMs, RAG systems, or agentic AI architectures is a strong differentiator.
  • Deep familiarity with MITRE ATLAS and OWASP Mobile, Web, API and LLM Top 10 attack frameworks.
  • Experience managing external pentest vendors.
  • Experience in regulated environments (banking, fintech, insurance, critical infrastructure) preferred.

SKILLS

  • Proficiency with offensive security tools — Burp Suite, Metasploit, Nmap, and custom scripting.
  • Sr VAPT Engineers: proficiency with AI vulnerability testing tools (PyRIT, garak, Promptfoo) and ability to produce board-ready findings reports.
  • VAPT Engineers: growing proficiency across offensive tools and methodologies.
  • Ability to communicate findings clearly to technical and non-technical audiences.
  • Understanding how to scope and execute adversarial exercises safely in a live banking environment.

PREFERRED CERTIFICATIONS

  • OSCP, OSCP+ OSEP, CREST CPSA or CRT (Sr VAPT Engineers); OSCP in progress (VAPT Engineers).
  • GIAC GPEN, GWAPT, or GXPN.
  • CompTIA PenTest+.

What We Value

  • Revolutionary in our thinking.
  • Innovative in our products, services and the way we work.
  • Genuine in our intentions.
  • Honourable in our actions.
  • Tenacious in overcoming challenge.

JR00000604

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against rytbank's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on rytbank's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    rytbank's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.