Cybersecurity Senior Offensive & Defensive Engineer(Oniste)

Nexsoll · Bahawalpur division, Pakistan

Company Description

Nexsoll is a privately held digital innovation firm that helps organizations accelerate growth through lead generation, strategic digital marketing, and enhanced customer engagement. Founded in 2024, . Our users trust us with their data, and we treat that as a promise. We’re looking for an elite security expert who thinks like an attacker and builds defenses like an engineer.

The Challenge

Picture this: 10,000 skilled blackhat hackers launch a coordinated attack on our systems at the same time. They probe every API, every login form, every cloud bucket and every employee inbox.

Your job is to make sure they leave with nothing.

You’ll find our critical vulnerabilities before anyone else does, fix them at the root, and build a security setup that holds up against large-scale, persistent, real-world attacks.

What You'll Do

• Hunt for critical bugs. Run deep penetration tests and code reviews across our web apps, APIs, mobile apps, cloud infrastructure and internal networks.
• Think like the adversary. Run red team exercises that simulate real attack chains, from initial access through privilege escalation, lateral movement and data exfiltration.
• Build layered defenses. Design and implement defense-in-depth: WAF, rate limiting, bot mitigation, DDoS protection, zero-trust access and network segmentation.
• Harden everything. Lock down cloud (AWS, Azure or GCP), containers, CI/CD pipelines, secrets management and identity and access management.
• Detect and respond. Set up monitoring, SIEM and alerting, and write incident response playbooks so attacks are caught in minutes, not months.
• Secure the code. Work with developers to build security into the development lifecycle through threat modeling, SAST/DAST, dependency scanning and secure code review.
• Lead incident response. When something happens, you’re the calm voice in the room who contains it, investigates it and makes sure it never happens again.
• Raise the bar. Train the engineering team, set security standards and turn security into part of the culture, not a bottlenec

What You Bring

• 7+ years of hands-on experience in offensive and/or defensive security
• A proven record of finding critical vulnerabilities (CVEs, bug bounty Hall of Fame entries, published research or real pentest results)
• Deep knowledge of the OWASP Top 10, API security, authentication and authorization flaws, injection, SSRF, deserialization and business logic bugs
• Strong experience with tools like Burp Suite, Metasploit, Nmap, Ghidra/IDA, Cobalt Strike or similar
• Solid cloud security experience (AWS, Azure or GCP) and container/Kubernetes hardening
• Experience defending against DDoS, credential stuffing, bot attacks and automated exploitation at scale
• The ability to code and script (Python, Go, Bash or similar) to build tools and automate defenses
• Clear communication: you can explain a critical risk to a developer and to the CEO
• A ranking on HackerOne, Bugcrowd or Intigriti, or CTF competition wins
• Published CVEs, security research or conference talks (DEF CON, Black Hat, BSides)
• Experience with SOC 2, ISO 27001 or PCI-DSS compliance
• Experience with SOC 2, ISO 27001 or PCI-DSS compliance
• Malware analysis, reverse engineering or threat intelligence experience

What We Offer

Competitive salary + performance bonus

A leadership team that takes security seriously