Staff Security Engineer, Penetration Tester

What will you do?

• Lead or execute authorized penetration-testing engagements across web applications, mobile applications, APIs, and cloud-related attack surfaces.
• Define testing scope, identify attack surfaces, select appropriate testing methods, and document evidence, limitations, and outcomes.
• Assess discovered vulnerabilities, validate technical impact, distinguish verified findings from false positives, and provide remediation guidance.
• Use Linux, command-line utilities, and penetration-testing tools to perform controlled testing and verify results.
• Build or modify scripts that support request automation, test-data processing, or security-test result analysis.
• Coordinate testing scope, ownership boundaries, escalation paths, status updates, and deliverables with the Korea security team and Taiwan stakeholders.
• Independently manage engagement priorities and review testing output to identify gaps and provide specific technical guidance.

Basic Qualifications

• Demonstrated hands-on penetration-testing capability across web, mobile, or API environments.
• Demonstrated experience using penetration-testing tools in Linux or command-line environments.
• Ability to assess vulnerabilities, explain supporting evidence and impact, and provide actionable remediation guidance.
• Experience testing multiple applications, external services, or internal applications through penetration-testing or legally authorized bug-bounty work.
• Offensive-security experience sufficient to carry out penetration-testing engagements.
• Ability to communicate security findings and remediation guidance in English and Traditional Chinese.
• Ability to collaborate across Taiwan and Korea security activities, including scope coordination, responsibility boundaries, escalation, and delivery communication.

Preferred Qualifications

• Experience in Red Team or adversary-simulation experience in a complex application environments.
• Exposure to cloud-security testing, including architecture, identity and access, public interfaces, or configuration risks.
• Relevant offensive-security certification such as OSCP, OSCE, OSED, CREST, or SANS.
• Ability to demonstrate an authorized penetration-testing case covering scope, methodology, evidence, findings, limitations, and delivery outcome.
• Ability to complete a controlled attack-surface analysis and testing plan for a multi-interface application.
• Ability to compare remediation options based on risk reduction, constraints, and validation approach.
• Ability to prepare concise bilingual security summaries for technical and cross-regional stakeholders.
• A degree in Computer Science, Computer Engineering, or a related field.

Recruitment Process

• • Application Review - Phone Interview - Onsite (or Virtual Onsite) Interview - Offer
  • The exact nature of the recruitment process may vary according to the specific job and may be changed due to scheduling or other circumstances.
  • Interview schedules and the results will be informed to the applicant via the e-mail address submitted at the application stage.

Details to Consider

• • This job posting may be closed prior to the stated end date for application if all openings are filled.
  • Coupang has the right to rescind an offer of employment if a candidate is found to have submitted false information as part of the application process.
  • Those eligible for employment protection, including recipients of veteran’s benefits and persons with disabilities, may receive preferential treatment for employment in accordance with applicable laws.