Senior Security Research Engineer, Cymetrics

Responsibilities

• 規劃以及執行滲透測試，協助客戶發現漏洞並進行改善且驗證修復結果。
• 與客戶進行專案會議，開會溝通，釐清並協助客戶解決問題。
• 協助自動化資安工具開發，與軟體工程團隊一同完成自有 SaaS 產品。
• 與產品開發團隊合作，協助改進資安產品及平台。
• 研究網站或開源專案漏洞，將研究結果寫成文章發佈至公司的技術文章部落格。
  
  
• Planning and executing penetration tests, aiding clients in identifying vulnerabilities, verifying remediation, and validating fix outcomes.
• Conducting project meetings with clients, engaging in effective communication, clarifying issues, and assisting clients in problem resolution.
• Assisting in the development of automated security tools, collaborating with the software engineering team to complete proprietary SaaS products.
• Collaborating with the product development team to enhance cybersecurity products and platforms.
• Researching vulnerabilities in websites or open-source projects and documenting findings in articles published on the company's TechBlog.
  
  

• 四年以上滲透測試和內網橫向滲透的實際工作經驗，並專注在 Web 應用安全方面。
• 需對現代Web框架（如React, Angular, Vue.js）和客戶端安全弱點（例如XSS, CSRF, CSP bypass, GraphQL等）有深入研究。
• 熟悉 OWASP 測試指南和其他安全測試方法，對網頁漏洞、作業系統、網路架構有深入理解，並熟悉其背後原理。
• 能夠清晰地整理和撰寫測試結果及修補建議，並有效地與團隊和客戶溝通。
• 流利的中英文聽說能力，並與客戶講解滲透測試報告內容。
  
  
• Four or more years of practical experience in penetration testing and lateral movement in internal networks, fuscous on web application security.
• In-depth knowledge of modern web frameworks (such as React, Angular, Vue.js) and client-side security vulnerabilities (e.g., XSS, CSRF, CSP bypass, GraphQL).
• Familiarity with OWASP testing guides and other security testing methodologies, with a deep understanding of web vulnerabilities, operating systems, network architecture, and underlying principles.
• Ability to articulate and document test results, provide remediation suggestions clearly, and effectively communicate with teams and clients.
• Fluency in spoken and written Chinese and English to explain penetration test reports to clients.

• 對區塊鏈相關的資安技術有興趣
• 有打過知名廠商 bug bounty 或是參加過國際 CTF 的經驗 (或有同等 CVE 弱點)
• 擁有 OSWE 或 OSCP 證照 (或其它同等資訊安全證照)
• 擅長撰寫資安相關之技術文章（漏洞研究、CTF writeup 等等）
• 參與過開源項目，展現對安全社群的貢獻和合作精神。
  
  
• Interest in blockchain-related cybersecurity technology.
• Experience in bug bounty programs from reputable companies or participation in international CTFs (or equivalent CVE vulnerabilities).
• Possession of OSWE or OSCP certifications (or other equivalent information security certifications).
• Proficiency in writing technical articles related to cybersecurity (vulnerability research, CTF write-ups, etc.).
• Involvement in open-source projects, demonstrating contributions to and collaboration within the security community.