网络安全顾问（渗透测试）

科擎科技有限公司（iGears）自2004年起为香港机构开发软件，并营运20个自家SaaS平台，现正成立网络安全团队。此职位负责为香港及加拿大客户的网页应用程式、API及流动应用程式进行渗透测试，撰写报告及进行复测，并负责测试公司自家平台的安全。申请人须持有OSCP或同等认证，并具最少两年实际渗透测试经验。月薪HK$30,000至50,000（视乎经验及认证）。

关于 iGears

iGears Technology Limited (科擎科技有限公司) has built software for Hong Kong organisations since 2004, including listed companies, public-sector bodies, NGOs, education organisations and churches. We develop and run 20 of our own SaaS products, and our MobPage division has published 200+ mobile apps. With offices in Hong Kong and Edmonton, Canada, we are now building an in-house cybersecurity team to deliver penetration testing, security risk assessments and privacy impact assessments for clients, and to secure our own platforms.

工作安排

Full-time and part-time arrangements are welcome. On-site or hybrid arrangements are welcome.

工作职责

• Plan and run penetration tests of web applications, APIs and mobile apps for clients in Hong Kong and Canada, following OWASP WSTG, ASVS and MASVS
• Test how applications connect to third-party services (OAuth, webhooks, payment and messaging APIs) and cloud environments
• Verify every finding by hand, rate risk with CVSS, and write clear reports with fix guidance for developers and management
• Retest fixes and issue verification letters
• Help scope engagements: rules of engagement, test accounts, testing windows and authorisation letters
• Contribute hands-on testing to security risk assessments and audits (SRAA)
• Test and harden iGears’ own SaaS platforms, and coach our developers on secure coding

申请要求

• OSCP, or an equivalent hands-on certification (e.g. CREST CRT or CCT, GIAC GPEN or GWAPT, eWPTX, PNPT)
• At least 2 years of hands-on penetration testing, with web application and API testing as core skills
• Strong command of Burp Suite and common testing tools; scripting in Python, Bash or similar
• Clear written English for client reports
• The right to work in Hong Kong

优先考虑条件

• OSWE, OSEP, BSCP or CREST CCT APP
• Mobile (iOS/Android), Active Directory or cloud (AWS, Azure, GCP) testing
• Source code review
• CVEs, bug bounty findings or a CTF track record
• Spoken Cantonese, for working with Hong Kong clients

我们提供的待遇

• HK$30,000–50,000 a month, depending on experience and certifications
• Real client engagements, plus 20 in-house SaaS products to test and secure
• A founding role in our new security team, reporting to our CTO
• MPF, 15 days’ annual leave, medical cover, and support for relevant training and certification exams

申请前了解我们的平台

• AI: GenCMS (gen-cms.com), AskCore (askcore.org), HumanLevelUP (humanlevelup.org), PromoPilot (promo-pilot.org), Webetter (webetter.co), PhotoCen (photocen.com), Duckbot (duckbot.hk, preview)
• Business operations: fileEC (fileec.com), InsightBook (insightbook.org), HRFlowTech (hrflowtech.com), MemberSys (membersys.org), AppointSys (appointsys.org), Paperless.Cards (paperless.cards)
• Messaging and marketing: SendPromotion.Email (sendpromotion.email), SendSMS.click (sendsms.click), MarketHK (markethk.net)
• Education and community: LearnSys (learnsys.org), ITChurch (itchurch.online)
• Directories: E12 (e12.hk, e12.ca) and E12 Careers (jobs.e12.hk, jobs.e12.ca)

Full list: https://www.igears.com.hk/platforms/

申请方法

Email your CV to [email protected] with the subject “Security Consultant (PT) – Your Name”. Please include links to or IDs for your certifications (e.g. OffSec credential link, CREST or Credly badge, ISACA or ISC2 certificate number), and your expected salary and notice period. Only shortlisted candidates will be contacted.

iGears is an equal opportunity employer. This role is open to all qualified applicants.

Personal data you provide will be used by iGears Technology Limited only for recruitment. Providing it is voluntary, but we can’t consider your application without it. It may be shared with other iGears offices if you are considered for a role there. Data of unsuccessful applicants is destroyed within two years. To access or correct your data, or for our full Personal Information Collection Statement, email [email protected].

申请人提供的个人资料只会用作招聘用途。不获取录申请人的资料将于两年内销毁。如需查阅或更正个人资料，或索取完整的收集个人资料声明，请电邮至[email protected]。

https://e12.hk/pages/company.php?slug=igears-technology-limited

iGears Technology Limited (科擎科技有限公司) has built software for Hong Kong organisations since 2004, including listed companies, public-sector bodies, NGOs, education organisations and churches. We develop and run 20 of our own SaaS products, and our MobPage division has published 200+ mobile apps. With offices in Hong Kong and Edmonton, Canada, we are now building an in-house cybersecurity team to deliver penetration testing, security risk assessments and privacy impact assessments for clients, and to secure our own platforms.