Looking for a job

Ivan Radityatama

@ivanradityatama

Offensive Security Engineer at Bank Saqu, emulating APT groups to validate detection and turn exploitation chains into tuned controls.

Indonesia

Message

At Bank Saqu, I plan and run purple team exercises emulating threat groups including LockBit, ShadyPanda, Lazarus Group, and FIN6. I map activity to MITRE ATT&CK and validate detection across XDR, SIEM, and RASP.

I document multi-stage exploitation chains and work with the blue team to turn them into tuned security controls, detection rules, and incident-response procedure changes. I also lead onsite physical security assessments and wireless red team operations.

My work at Bank Saqu includes reverse-engineering native libraries to research RASP bypasses, root and tamper detection, and SSL pinning in hardened banking apps. Previously, I tested infrastructure, web applications, APIs, and mobile applications, and built Python automation to identify authorization flaws in banking APIs.

Experience

Work history, roles, and key accomplishments

Current

Associate Offensive Security Operator

Current

Bank Saqu (Astra Financial)

Apr 2026 - Present (7 months)

Plan and run purple team exercises emulating APT threat groups with MITRE ATT&CK TTP mapping to validate detection and response across XDR, SIEM, and RASP. Lead physical security assessments, wireless red team operations, and RASP research on hardened banking apps.

Purple Team Adversary Emulation MITRE ATT&CK EDR XDR SIEM RASP Physical Security Wireless Red Teaming Reverse Engineering Mobile Security

Cyber Security Consultant

BumiAmartha Teknologi Mandiri

Oct 2025 - Apr 2026 (6 months)

Delivered VAPT engagements on web applications, APIs, and mobile applications for client companies. Ran full-cycle assessments from reconnaissance through exploitation and impact validation, documenting reproducible proof-of-concepts.

Vulnerability Assessment Penetration Testing Web Application Security API Security Mobile Security Exploitation Proof of Concept

Application Security Engineer

Bank Saqu (Astra Financial)

Jan 2025 - Apr 2026 (1 year 3 months)

Performed infrastructure, web application, API, and mobile penetration testing across the digital banking platform. Built Python automation for authorization-matrix sweeps and researched attack scenarios targeting banking KYC processes.

Penetration Testing Web Application Security API Security Mobile Security Python Tenable Nessus BOLA IDOR BFLA KYC

Penetration Tester

Widya Security

Nov 2024 - Dec 2025 (1 year 1 month)

Performed infrastructure penetration testing covering network devices, internal systems, and internet-facing services. Executed vulnerability assessments and validated exploitability of critical findings, delivering triage steps and severity rationale.

Infrastructure Testing Vulnerability Assessment Network Security Exploitability Validation

Cyber Security Engineer

PT. Serasi Autoraya (Astra International)

Aug 2024 - Jan 2025 (5 months)

Conducted web application penetration testing across internal and internet-facing systems. Performed DAST with Tenable Nessus and SAST with SonarQube for code-level vulnerability detection.

Web Application Penetration Testing (WAPT)DAST SAST Tenable Nessus SonarQube