Senior Offensive Security Analyst

JOB DESCRIPTION:

• Execute and/or support penetration testing against internal and external assets.
• Penetration testing activities but not limited to; networks, web applications, and cloud assets.
• Development and maturation of the purple /adversarial emulation team.
• Develop associated reports related to penetration testing and or purple teaming efforts and findings. Ability to develop and communicate the risk of findings derived from penetration testing activities and or purple teaming efforts.
• Collaboration with the Incident Response team to support adversarial emulations executed against implemented security controls and or associated processes.
• Leverage tactical expertise in exploit testing and proof-of-concept development and analysis, to assist with identifying attack vectors that may pose a risk to overall security posture.
• Collaboration with multiple teams such as Cyber Threat Action Center (CTAC), Threat Intelligence, Threat and Vulnerability Management, Risk and Compliance, and Cybersecurity Architecture. 
• Conduct and/or support internal and external penetration testing efforts against assets.
• Development and maturation of Offensive Security Operations team.
• Conduct validation of findings from Attack Surface Management activities.
• Develop reports and recommendations based on findings from penetration testing and or purple teaming efforts.
• Execute Purple Team and Adversarial attack emulations.
• Effectively communicate findings and strategy to stakeholders including technical staff and executive leadership within and outside of the Cybersecurity Operations organization.
• Lead and assist with scoping penetration tests and or purple team requests.
• Demonstrate advanced understanding of business processes, Cyber risk management, Cybersecurity penetration testing frameworks, IT controls and related standards e.g., MITRE ATT&CK, NIST 800-171, CIS, etc.
• Development and or maintenance of existing policies, processes related to penetration testing, and or purple team responsibilities.
• Develop comprehensive exploitation strategies that identify exploitable technical or operational vulnerabilities.
• Understanding of evolving Advanced Persistent Threats (APT) and Tactics, Techniques, and Procedures (TTP).
• Knowledge of endpoint and network defenses and detection methodologies.
• Understanding of incident response lifecycle.
• Lead and execute assumed breach exercises.
• Perpetually develop and strengthen skills, knowledge, and functional abilities related to offensive security.
• Serve as an Offensive Security SME during incident response triage activities.
• Identify gaps in our understanding of target technology and develop innovative collection approaches.
• Create comprehensive exploitation strategies that identify exploitable technical or operational vulnerabilities.

EDUCATION AND EXPERIENCE:

• Hands-on experience but not limited to, Kali Linux, Metasploit, Cobalt Strike, Burp Suite, OWASP ZAP, Hack the Box, TryHackMe, VulnHub, MITRE ATT&CK, Attack Surface Management
• Understanding of frameworks such as PTES (Penetration Testing Execution Standard), OWASP (Open Web Application Security Project)