Staff Security Engineer, Penetration Tester

About the role

Coupang is expanding its operations in Taiwan and is looking for a Staff Security Engineer who will act as a Penetration Tester. The role covers hands-on penetration testing of web, mobile, API and cloud-related environments, identifying and validating vulnerabilities, communicating their technical impact and giving actionable remediation guidance while working with the Korea security team. The engineer is expected to independently own penetration-testing engagements and guide fellow engineers.

Key responsibilities

• Lead or execute authorized penetration-testing engagements across web applications, mobile applications, APIs and cloud attack surfaces.
• Define testing scope, identify attack surfaces, choose testing methods and document evidence, limitations and outcomes.
• Assess vulnerabilities, validate their impact, distinguish verified findings from false positives and give remediation guidance.
• Use Linux, command-line utilities and penetration-testing tools to run controlled tests and verify results.
• Build or modify scripts for request automation, test-data processing and result analysis.
• Coordinate scope, ownership, escalation paths, status updates and deliverables with the Korea security team and Taiwan stakeholders.
• Manage engagement priorities independently and review testing output to identify gaps.

Required profile

• Demonstrated hands-on penetration-testing capability across web, mobile or API environments.
• Experience testing multiple applications, external services or internal applications through penetration testing or legally authorized bug-bounty work.
• Fluency in Mandarin Chinese and English, able to communicate security findings in both languages.
• Ability to collaborate across Taiwan and Korea security activities.
• Preferred: Red Team or adversary-simulation experience, exposure to cloud-security testing, and a degree in Computer Science, Computer Engineering or a related field.

Required skills

• Penetration-testing tools in Linux or command-line environments.
• Preferred: offensive-security certifications such as OSCP, OSCE, OSED, CREST or SANS.

The recruitment process runs through application review, job-fit interview, focus interview and offer, and the exact steps may vary. The posting may close early if all openings are filled.