Cyber Security Expert (Night Shift)

About the role

Comtanix, a fast-growing BPO, is looking for an experienced Cyber Security Expert to protect its websites, web applications, cloud infrastructure, servers, databases and internal systems. The role involves identifying vulnerabilities, preventing cyber attacks, conducting security assessments and implementing security measures. It is based in Bahria Town, Phase 8, Rawalpindi, on a night shift from 7 PM to 4 AM Monday to Friday, and requires in-person attendance.

Key responsibilities

• Secure websites and applications built with Next.js, React.js, Node.js, PHP and Laravel.
• Conduct vulnerability assessments, authorized penetration testing and security audits.
• Identify and prevent common web application attacks such as SQL injection, XSS and unauthorized access.
• Manage Cloudflare security, including WAF, DDoS protection, rate limiting, DNS and SSL/TLS.
• Secure Linux/Windows servers, cloud infrastructure, networks, firewalls and remote access.
• Implement database security for MySQL, PostgreSQL and MongoDB, including access controls, encryption and backup protection.
• Monitor security logs, investigate suspicious activity and respond to security incidents.
• Review API security, authentication, access permissions and third-party integrations.
• Remediate vulnerabilities in applications, dependencies, servers and cloud configurations.
• Collaborate with DevOps and development teams on security best practices and DevSecOps.
• Maintain security documentation, risk assessments and incident reports.

Required profile

• 3-5+ years of hands-on cyber-security experience.
• Strong knowledge of web application security and OWASP Top 10.
• Experience with penetration testing tools such as Burp Suite, OWASP ZAP and Nmap.
• Knowledge of Cloudflare, Linux, firewalls, DNS, SSL/TLS and network security.
• Experience with AWS, Azure or Google Cloud security.
• Understanding of database security and optimisation risks.
• Familiarity with vulnerability management, incident response, security monitoring, SIEM tools, secure coding practices and API security.
• Relevant certifications such as Security+, CEH or OSCP are a plus.
• Preferred: practical experience securing enterprise websites, cloud servers, databases, APIs and business-critical applications.