Join Our Team
Build your career with Hong Kong's offensive security team
Cutting-Edge Work
Work on challenging security projects with the latest techniques
Small Team
Collaborate closely with experienced security professionals
Growth Opportunities
Continuous learning and certification support
Open Positions
Find your next opportunity with us.
Join our offensive security team to conduct advanced penetration testing and red team operations against enterprise environments. You will work alongside senior security professionals to identify vulnerabilities, develop exploits, and help clients strengthen their security posture.
Responsibilities
7- 01Conduct end-to-end penetration testing across web applications, internal and external networks, cloud infrastructure, and mobile platforms. Every engagement follows recognised methodologies (OWASP, PTES, OSSTMM) so that coverage is consistent, repeatable, and defensible to the client. You scope the work with the client, agree on rules of engagement, then systematically test each layer and document evidence for every confirmed finding.
- 02Participate in full-scope red team engagements that emulate real adversaries rather than checklist testing. This covers the full attack chain: gaining initial access, moving laterally across the network, escalating privileges, establishing persistence, and reaching the agreed objective (such as simulated data exfiltration). You also take part in social-engineering and phishing campaigns that test the human layer of defence.
- 03Develop, customise, and extend exploitation tooling, payloads, and scripts so they bypass modern defences such as EDR, antivirus, AMSI, and network segmentation. Off-the-shelf tooling rarely survives a mature environment, so you will adapt payloads and infrastructure to each target and keep them maintainable for the rest of the team to reuse.
- 04Author clear, audience-appropriate technical reports. Each report maps findings to business risk, includes reproducible evidence so the client can verify the issue, and gives prioritised, actionable remediation guidance rather than a generic list of fixes. The goal is a report a CISO can act on and an engineer can reproduce.
- 05Research emerging attack techniques, new CVEs, and adversary tradecraft, then publish findings internally and contribute to the team knowledge base and shared tooling. Staying current is part of the job: you are expected to read advisories, reproduce interesting techniques in the lab, and turn that into reusable capability.
- 06Work directly with client stakeholders, from engineers to executives, to walk through findings, demonstrate real impact, and help prioritise remediation. You translate raw technical detail into business consequences so the client understands what matters most and why.
- 07Mentor junior team members, take part in internal technical training, and uphold engagement quality standards and ethical guidelines. Offensive work carries real responsibility, so integrity, clear rules of engagement, and careful handling of client data are expected at every step.
Requirements
7- OSCE3 certification is required (the full OSEP + OSWE + OSED combination). Holding BSCP, CRTM, or OSIR as well is a strong advantage and signals breadth across web, Active Directory, and malware-evaporation disciplines.
- Solid understanding of Windows and Linux internals, Active Directory, and common enterprise security architectures. You should be able to reason about how an environment is built, how trust flows between systems, and where the realistic attack paths are.
- Hands-on experience with industry-standard tooling such as Burp Suite Professional, Cobalt Strike, BloodHound, Nmap, and Metasploit. Familiarity means being able to configure and extend these tools, not just run default scans.
- Programming and scripting proficiency in Python, PowerShell, C#, Go, or Bash, enough to build and modify tooling as an engagement demands. You will not just consume tools; you will write and adapt them.
- Familiarity with evasion techniques and the ability to operate against mature, defended environments where EDR and monitoring are in place and simple attacks will be caught.
- Excellent written and verbal communication skills. You must be able to explain complex technical issues clearly to both technical engineers and non-technical executives, in reports and in live meetings.
- Self-motivated, detail-oriented, and able to work independently while documenting every step of an engagement so that findings are reproducible and the client record is complete.
Design intuitive interfaces for our security tools and client dashboards. Create seamless experiences for complex security workflows, making advanced security concepts accessible to users of all technical levels.
Responsibilities
7- 01Design intuitive, accessible user interfaces for internal security tools, client-facing dashboards, and command-and-control platforms. The aim is to make complex, multi-step workflows easy to navigate, so that operators can focus on the work instead of fighting the interface.
- 02Translate product requirements into wireframes, interactive prototypes, and high-fidelity mockups that clearly communicate structure, flow, and interaction before any code is written. This lets the team validate direction early and avoid costly rework later.
- 03Plan and conduct user research, interviews, and usability testing with both technical operators and non-technical clients. You use what you learn to validate design decisions and uncover real pain points, rather than relying on assumptions.
- 04Build, document, and maintain a scalable design system and component library that ensures visual and interaction consistency across all COFFSec products. Consistent components also make engineering handoff faster and less error-prone.
- 05Partner closely with developers throughout implementation, providing specs, assets, and QA feedback, so that the shipped product matches the intended design quality rather than drifting during build.
- 06Present design concepts and rationale to stakeholders, iterate based on feedback, and balance user needs with technical and business constraints. You are expected to explain why a design works, not just how it looks.
- 07Advocate for accessibility (WCAG) and responsive design so that our tools work across devices and for all users, including those relying on assistive technology.
Requirements
7- 3 or more years of professional UI/UX design experience, ideally on complex B2B or enterprise products where flows and data density are the real challenge.
- A strong portfolio demonstrating end-to-end product thinking, from discovery research and user flows through to polished, high-fidelity visual design and the reasoning behind it.
- Proficiency in Figma or a comparable tool, including prototyping, auto-layout, component libraries, and design tokens that keep a system scalable.
- Solid understanding of design systems, component-based design, and the handoff process with engineering teams, so designs reach production cleanly.
- Experience designing data-heavy dashboards, dense operational tools, or information-visualisation interfaces is a strong plus, given the nature of our products.
- Knowledge of accessibility standards (WCAG) and responsive design principles, and how to apply them in practice rather than as a checklist.
- Genuine interest in the cybersecurity industry and a willingness to learn the domain, so your designs fit how security work actually happens.
Build and maintain our web applications, security tools, and client portal infrastructure using modern frameworks. You will work on customer-facing applications as well as internal tools that support our security operations.
Responsibilities
7- 01Develop and maintain customer-facing and internal React-based web applications, owning features end to end from implementation through deployment. Ownership means you care about how a feature behaves in production, not just that it compiles.
- 02Design and build robust, well-documented RESTful and GraphQL APIs and backend services using Node.js, with clear versioning and consistent error handling so clients and frontends can rely on them.
- 03Implement secure authentication, authorisation, and session management (OAuth, SSO, RBAC), and apply secure-coding practices throughout: input validation, output encoding, and least privilege. Given we are a security company, our own code has to set the example.
- 04Optimise applications for performance and scalability, reducing bundle size, improving load times, and ensuring the architecture grows with user demand rather than breaking under it.
- 05Write clean, maintainable, well-tested, and well-documented code, with meaningful tests and a clear commit history so the team can review and extend your work confidently.
- 06Participate actively in code reviews and technical discussions, giving constructive feedback and helping raise overall code quality across the team.
- 07Collaborate with security engineers so that our own products reflect the standards we advise clients to follow, turning security best practice into shipped product behaviour.
Requirements
7- Strong proficiency in React and modern JavaScript/TypeScript, including hooks, state management, and component architecture, with the ability to build production features without hand-holding.
- Solid experience building Node.js backends, including APIs, services, and integrations with third-party systems that run reliably in production.
- Understanding of RESTful API design principles, including versioning, pagination, and error contracts, so that your APIs are predictable and easy to consume.
- Familiarity with relational and document databases (PostgreSQL, MongoDB), including schema design and query optimisation for realistic data volumes.
- Security awareness and hands-on secure-coding practices: the OWASP Top 10, dependency management, and secrets handling are part of how you write code, not an afterthought.
- Experience with cloud platforms (AWS, GCP) and containerisation (Docker) is a plus and useful as we scale our infrastructure.
- Comfort working in a small, fast-moving team where you own outcomes, not just tasks, and where priorities can shift with client needs.
Drive brand awareness and lead generation for our security services through digital marketing, content creation, and industry engagement. Help position COFFSec as Hong Kong's premier offensive security provider.
Responsibilities
7- 01Plan and execute digital marketing campaigns across search, social, and email channels, aligned to brand and lead-generation goals. Each campaign has a clear objective, target audience, and set of metrics so success is measurable.
- 02Create engaging content for social media, our blog, and newsletters that explains offensive security topics to both technical and business audiences, translating specialist concepts into language each audience finds useful.
- 03Build and manage relationships with industry partners, associations, and media outlets to extend COFFSec's reach and credibility over time, not just one-off posts.
- 04Organise and represent COFFSec at industry events, conferences, and webinars, covering everything from early planning and logistics to on-site promotion and follow-up afterwards.
- 05Track, analyse, and report on marketing metrics and return on investment, and use those insights to refine campaigns and the channel mix rather than relying on gut feel.
- 06Support the business-development team with sales materials, case studies, and pitch decks that clearly communicate our value and help close conversations with prospects.
- 07Help shape and protect the COFFSec brand voice across every customer touchpoint, so the company sounds consistent wherever a prospect meets us.
Requirements
6- Experience in B2B marketing, preferably in technology or security, with familiarity of the long, considered-purchase sales cycles typical of enterprise buyers.
- Strong written and verbal communication skills in English and Traditional Chinese, with the ability to translate technical concepts into clear, compelling messaging.
- Familiarity with digital marketing tools and analytics platforms (Google Analytics, Google Ads, social management, and email marketing) and the ability to read the numbers they produce.
- Understanding of the cybersecurity industry and its key audiences is a strong advantage, so your messaging lands with the right people in the right tone.
- Creative thinker with strong attention to detail and a sense for brand and tone, able to keep quality high across many small pieces of content.
- Able to work independently and collaborate across a small, cross-functional team where marketing touches product, sales, and delivery.