Who this is for
This is for security-minded testers who are comfortable owning vulnerability analysis end-to-end, from scoping through to validating remediation, and communicating risk clearly to both technical and business stakeholders.
Career opportunity
Security Engineer (Testing)
This is for security-minded testers who are comfortable owning vulnerability analysis end-to-end, from scoping through to validating remediation, and communicating risk clearly to both technical and business stakeholders.
Apply for This Role →LocationCape Town / Johannesburg / Durban / Remote
Experience3+ years
Employment typeContract
About the role
QoT places Security Engineers with clients across banking and payments, iGaming, telco, insurance, and general technology. As a Security Engineer, you'll protect delivery quality and client risk posture by identifying, validating, prioritising, and communicating security weaknesses across applications, services, APIs, and delivery pipelines. The specific client and domain will be confirmed as part of the placement process.
What you'll do
- Identify relevant security test conditions, attack surfaces, and risk areas from requirements and architecture.
- Execute security testing across web, service, API, and configuration layers.
- Analyse findings to determine exploitability, severity, and remediation implications in context.
- Document vulnerabilities clearly and responsibly, with sufficient evidence to support developer action.
- Retest remediated issues to validate whether controls effectively reduce the identified risk.
- Support integration of security checks into delivery workflows and pipelines.
What you'll need
- 3+ years' experience in application security testing, vulnerability analysis, or related engineering work.
- Hands-on exposure to web, API, service, or platform security testing.
- Working knowledge of OWASP-aligned concepts, SAST/DAST, and secure SDLC principles.
- Experience using security tooling for scanning, validation, and issue analysis.
- Clear, professional communication when handling sensitive findings and client information.
Nice to have
- Exposure to banking/payments, iGaming, telco, or insurance environments.
- CompTIA Security+, ISTQB Security Tester, or equivalent certification.
- Cloud foundation certification (e.g. Azure or AWS fundamentals).
- Exposure to DevSecOps practices or Kubernetes-based environments.
Work setup
- Location: Cape Town, Johannesburg, or Durban, with hybrid/remote flexibility depending on client requirements.
- Employment type: contract, with length set by the client engagement. Some roles are fixed-term, others roll on an ongoing basis.
- Some travel to client sites may be required depending on engagement.