Role Description We are seeking a highly skilled Senior Security Engineer with 6+ years of hands-on experience in offensive security. The ideal candidate will be responsible for identifying, exploiting, and reporting security vulnerabilities across applications, networks, and infrastructure to proactively strengthen the organization's security posture. This role requires deep technical expertise, strong analytical skills, and the ability to simulate real-world cyberattacks while providing actionable remediation strategies. - Lead and execute web, mobile, API, and network penetration testing engagements - Perform advanced vulnerability assessments, including manual and automated testing techniques - Identify, exploit, and validate security vulnerabilities across systems and applications - Conduct red team exercises and adversary simulations to assess defensive capabilities - Evaluate security posture against standards such as OWASP Top 10, SANS Top 25, and MITRE ATT&CK framework - Perform secure code reviews and assist in identifying flaws in application logic and architecture - Collaborate with development and DevOps teams to ensure secure SDLC implementation - Provide detailed technical reports, including risk ratings, proof-of-concept (PoC), and remediation guidance - Support security audits, compliance assessments, and risk management initiatives - Mentor junior security engineers and contribute to knowledge sharing within the team - Stay updated with the latest vulnerabilities, exploits, and threat intelligence trends Qualifications - 6+ years of experience in penetration testing / ethical hacking / offensive security - Strong expertise in OWASP Top 10 vulnerabilities and remediation techniques - Hands-on experience with tools such as Burp Suite (Pro preferred), Metasploit Framework, Nmap, Nessus, Wireshark, Nikto, SQLmap, etc. - Deep understanding of web application security (authentication, session management, APIs) - Network protocols and security architecture - Operating systems (Linux/Windows hardening & exploitation) - Experience with manual testing techniques beyond automated scanners - Familiarity with cloud security (AWS/Azure/GCP) is a plus - Knowledge of scripting/programming (Python, Bash, or PowerShell) for automation - Understanding of security testing methodologies (Black-box, White-box, Grey-box testing) Requirements - Certifications (Preferred): OSCP (Offensive Security Certified Professional) – Highly preferred - CEH, eCPPT, GPEN, or similar certification Job Details - Location: Lahore/Islamabad/Karachi (Remote) - Experience: 7+ Years - Department: Network Security & Penetration Tester Company Description TEKHQS is a global technology solutions provider headquartered in Lake Forest, California, with a 300+ expert team in Pakistan. We specialize in ERP (SAP S/4HANA, Oracle NetSuite, Microsoft Dynamics 365), AI/ML, Blockchain, Cloud, and Staff Augmentation services. Join us to drive business growth and work on cutting-edge global IT projects with hands-on mentorship and a clear career path.

Role Description We are seeking a skilled and motivated Security Engineer to join our Incident Response team. The ideal candidate will play a critical role in supporting incident response activities across diverse environments, including Windows, MacOS, Linux, and AWS. You will work closely with senior engineers during investigations, assist in analysis, containment and recovery efforts, and contribute to the continuous improvement of our detection and response capabilities. This role provides the opportunity to grow your expertise while helping safeguard our organization against emerging threats. - Serve as the escalation point for high-priority and complex security incidents, providing advanced troubleshooting, root cause analysis, and remediation guidance. - Support incident response investigations across Windows, MacOS, and Linux environments, AWS cloud infrastructure and services, Endpoint protection platforms, SIEM and Identity management tools. - Conduct advanced malware analysis and forensics to determine threat vectors, persistence mechanisms, and impact. - Lead investigations, deliver actionable findings to leadership, and drive internal projects that enhance incident response processes, fostering continuous improvement and innovation. - Develop and optimize security playbooks, detection rules, and tooling—including AWS-native, third-party, and AI-integrated solutions—to strengthen overall security posture. - Collaborate with IT, DevOps, and cloud teams to assist in hardening and recovery efforts. - Continue to develop technical expertise through mentorship and hands-on involvement in investigations. - Work flexible hours as required to support incident response and business needs. Qualifications - 4+ years of hands-on experience in cybersecurity, with at least 2 years in a dedicated incident response role or with at least 3 years in L3 security operations role. - Working knowledge of security investigations related to Windows, MacOS, Linux, and AWS (CloudTrail, GuardDuty, etc.). - Scripting and automation familiarity (Python, PowerShell, or Bash) to assist in investigations. - Basic forensic investigation knowledge including image collection and chain of custody. Requirements - Familiarity with cloud-native and hybrid architectures. - Experience with security orchestration and automation platforms (SOAR) or automation workflows. - Experience collaborating with cross-regional or distributed teams. - Security certifications strongly preferred (e.g., GCIA, GCIH, GCFA, AWS Security Specialty, ECIH, OSCP, Security+). Benefits - Paid time off. - Retirement savings (e.g., 401k, pension schemes). - Bonus/incentive eligibility. - Equity grants. - Participation in our employee stock purchase plan. - Competitive health benefits. - Other family-friendly benefits including parental leave.

• Design and implement security control architectures and reference implementation patterns aligned with ISO 27001:2022 • Engineer and maintain assigned security controls across domains like Identity, Endpoint, Workloads, and Data • Develop, maintain, and operationalize security standards, baselines, and reference architectures • Perform threat modeling (STRIDE) and risk assessments for new systems • Lead security discovery and integration activities for new and existing environments • Proactively identify security improvement opportunities and execute approved work items • Integrate and optimize security tooling • Partner with Development and Application teams to embed security by design • Support audit and compliance activities related to ISO 27001:2022

Support acquisition integration by documenting security processes, identifying gaps in vulnerability tools, and assisting in the migration to standard tools while analyzing asset management and establishing governance reviews for vulnerabilities.