About the Team
We're building the next generation of digital banking infrastructure that combines enterprise-grade reliability with startup agility.
Our Cyber Security team is the backbone of our technology organisation, ensuring that innovation and trust go hand in hand as we scale Malaysia's first AI-powered digital bank.
You'll collaborate with some of the sharpest minds in the industry, operating in a supportive and dynamic environment that fosters creativity, exploration, and innovation.
Your next thrilling adventure starts here. Be part of shaping the future of digital banking today!
About the Role
VAPT Engineers sit within the 2nd-line CISO organisation at Ryt Bank, providing independent penetration testing and vulnerability assessment capability that is structurally separate from the 1st-line security function.
This role is for security professionals who are genuinely passionate about offensive security — finding vulnerabilities before adversaries do and helping Ryt Bank understand its real attack surface as an AI-powered digital bank.
What You'll Do
PENETRATION TESTING & VAPT
- Plan and execute quarterly vulnerability assessments across the bank's full infrastructure, applications, and API surface. Sr VAPT Engineers own and lead the programme; VAPT Engineers execute assessments and triage findings.
- Coordinate the annual intelligence-led penetration test covering internal network, external perimeter, applications, and APIs. Sr VAPT Engineers scope, manage, and validate; VAPT Engineers support execution.
- Lead the bank's triennial red team simulation — intelligence-led, adversary-simulated exercises targeting critical banking systems. Sr VAPT Engineers lead; VAPT Engineers participate and develop skills.
- Manage the external penetration testing firm relationship — scoping, reviewing methodologies, validating findings, and ensuring remediation is tracked. Led by Sr VAPT Engineers.
AI RED TEAM
- Own the bank's AI red-team programme, testing the bank’s adopted large language models, RAG pipelines, MCP-connected agents, and agentic workflows.
- Apply MITRE ATLAS (v5.4.0) techniques to simulate AI-targeted attacks: model API reconnaissance, training data poisoning, model evasion, prompt injection, indirect prompt injection via RAG documents, and confused-deputy attacks in agent-to-agent workflows.
- Test against OWASP Mobile, API, Web and LLM Top 10 (2025 edition) — covering prompt injection, sensitive information disclosure, excessive agency, system prompt leakage, vector and embedding weaknesses, and AI supply chain risks.
- Use AI red-team tooling to run systematic adversarial evaluations of the bank's AI systems. Sr VAPT Engineers own the programme; VAPT Engineers execute specific test scenarios.
- Produce AI security findings reports and coordinate remediation with the Lead, Security Engineering.
REMEDIATION & REPORTING
- Run purple team exercises in collaboration with the Lead, Cyber Operations — testing detection coverage, validating SIEM rules, and improving SOC response playbooks.
- Produce clear, actionable pentest and AI red-team reports for technical and non-technical audiences — including executive summaries for the CISO and board.
- Track all findings to remediation within agreed SLAs; escalate unresolved critical findings through the CISO.
- Provide technical security consultancy to engineering teams on high-risk features, novel architectures, and AI system deployments.
What We're Seeking
EXPERIENCE
- 3–7 years in penetration testing, red teaming, or offensive security roles with demonstrated independent delivery.
- Proven experience scoping, leading, and reporting on mobile and web applications, API, network, and cloud penetration tests.
- Hands-on experience with mobile, API and web application penetration testing
- Deep familiarity with AI penetration testing and tooling — testing LLMs, RAG systems, or agentic AI architectures is a strong differentiator.
- Deep familiarity with MITRE ATLAS and OWASP Mobile, Web, API and LLM Top 10 attack frameworks.
- Experience managing external pentest vendors.
- Experience in regulated environments (banking, fintech, insurance, critical infrastructure) preferred.
SKILLS
- Proficiency with offensive security tools — Burp Suite, Metasploit, Nmap, and custom scripting.
- Sr VAPT Engineers: proficiency with AI vulnerability testing tools (PyRIT, garak, Promptfoo) and ability to produce board-ready findings reports.
- VAPT Engineers: growing proficiency across offensive tools and methodologies.
- Ability to communicate findings clearly to technical and non-technical audiences.
- Understanding how to scope and execute adversarial exercises safely in a live banking environment.
PREFERRED CERTIFICATIONS
- OSCP, OSCP+ OSEP, CREST CPSA or CRT (Sr VAPT Engineers); OSCP in progress (VAPT Engineers).
- GIAC GPEN, GWAPT, or GXPN.
- CompTIA PenTest+.
What We Value
- Revolutionary in our thinking.
- Innovative in our products, services and the way we work.
- Genuine in our intentions.
- Honourable in our actions.
- Tenacious in overcoming challenge.
Skills Required
- 3–7 years of experience in penetration testing, red teaming, or offensive security roles
- Independent delivery experience in offensive security engagements
- Experience scoping, leading, and reporting on mobile, web application, API, network, and cloud penetration tests
- Hands-on mobile, API, and web application penetration-testing experience
- Familiarity with AI penetration testing and tooling, including LLMs, RAG systems, or agentic AI architectures
- Familiarity with MITRE ATLAS and OWASP Mobile, Web, API, and LLM Top 10 frameworks
- Experience managing external penetration-testing vendors
- Experience in banking, fintech, insurance, critical infrastructure, or another regulated environment
- Proficiency with Burp Suite, Metasploit, Nmap, and custom scripting
- For senior engineers, proficiency with PyRIT, garak, Promptfoo, or comparable AI vulnerability-testing tools
- Ability to produce board-ready findings reports and communicate with technical and non-technical audiences
- Ability to scope and execute adversarial exercises safely in a live banking environment
- OSCP, OSCP+, OSEP, CREST CPSA, or CRT certification
- GIAC GPEN, GWAPT, or GXPN certification
- CompTIA PenTest+ certification
What We Do
We are Ryt Bank, the World’s First AI-Powered Bank, fully licensed by Bank Negara Malaysia and the Ministry of Finance, and a member of PIDM. Backed by YTL Digital Capital Sdn Bhd with Sea Limited as shareholder, we bring together decades of experience and digital innovation to reimagine what banking should be: smarter, simpler, and built entirely around you. The future of banking is here, and it’s done right. 📲 Ryt Bank is now available on the App Store and Google Play.
