Application and Product Security I Analyst I

Vertiv Co; Pune District; On-site; INR 1,000,000 - 1,800,000; Full time

Job summary

Vertiv Co in Pune, India, seeks an Application and Product Security Analyst (Penetration Testing) to perform security pen testing, monitoring, and auditing across embedded devices and cloud services. You will document findings and work with senior engineers and testing leads to address risk.

The role is based in the Global R&D center in Pune and requires collaboration with the global security team to strengthen product security and enable secure deployments.

Qualifications

• Bachelor’s degree in information technology or computer science is desirable.
• Advanced security qualifications (OSCP/CEH) preferred.
• 2+ years in information, application, embedded product security or IT risk management.

Responsibilities

• Conduct security evaluation and threat assessments of embedded systems, mobile apps, and web apps.
• Perform pen tests, data bus monitoring, and protocol analysis on embedded and cloud products.
• Create detailed reports and proof-of-concept code documenting findings.
• Collaborate with engineering teams to improve security throughout the development lifecycle.

Skills

Penetration testing

Security auditing

Embedded systems

Web/mobile apps security

Threat assessment

Documentation

Report writing

GitLab

Education

Bachelors in IT/CS or related

Tools

IDA Pro

WinDbg

BinWalk

Valgrind

PIN

PANDA

S2E

Job description

About Vertiv

Vertiv (NYSE: VRT) brings together hardware, software, analytics, and ongoing services to ensure its customers’ vital applications run continuously, perform optimally, and grow with their business needs. Vertiv solves the most important challenges facing today’s data centers, communication networks and commercial and industrial facilities with a portfolio of power, cooling and IT infrastructure solutions and services that extends from the cloud to the edge of the network. A $4.5B company, headquartered in Columbus, Ohio, USA, Vertiv employs approximately 24,000 people and does business in more than 130 countries.

Position Summary

The Application and Product Security Analyst (Penetration Testing) is responsible for conducting security pen testing, monitoring, and auditing within a dynamic global organization. The products under test will have a range of possibilities from embedded devices to cloud services. Some of the products will be white box tests while others will be total black box engagements. A successful analyst will be able to take the product and evaluate the weak points in the design and implementation and focus in on those weaknesses to find security gaps under the guidance of senior engineers and testing leads. Analyst should clearly document the findings, analysis and prepare a detailed report.

This position will be primarily based out in Pune (Global R&D center), INDIA, and will consistently work under the guidance and processes of global security team and regional senior/lead test engineers.

Key Duties

• Conduct security evaluation and threat assessments of embedded systems, mobile applications, web applications
• Conduct research for the purposes of finding new vulnerabilities and enhancing existing capabilities
• Circumventing security protection methods and techniques
• Performing data bus monitoring (snooping) and data injection
• Conduct communications protocol analysis in the embedded products, and applications
• Conduct wireless communications channel snooping, and data injection
• Learn to reverse engineering complex systems and protocols
• Create detailed technical reports and proof of concept code to document findings
• Perform System Breakdown of the project/product before testing, identify and evaluate all the testing requirements and plan out the detailed testing activities, resources etc. with the help of Senior/Lead test engineers
• Provide proactive detailed interaction with respective engineering group on the testing needs, testing progress/status and provide detailed analysis report
• Use of Gitlab for issue management, tool usage experience preferred
• Preference given to other practical skills such as: functional analysis, memory image capture, static memory analysis, and data element extraction, etc.

Requirements

• A bachelor’s degree in information technology, Computer Science or related field is highly desirable.
• Additional advanced security qualifications such as OSCP (Offensive Security Certified Professional) certification, CEH (Certified Ethical Hacker) or equivalent preferred.
• Two or more years of experience (2+ years) in information, application, embedded product security and/or IT risk management with a focus on security, performance, and reliability
• Solid understanding of security protocols, cryptography, authentication, authorization and security
• Good working knowledge of current IT risks and experience implementing security solutions
• Ability to interact with a broad cross-section of personnel to articulate and enforce security measures
• Excellent written and verbal communication skills as well as business acumen
• Strong ability to establish partnerships and influence change and achieve results within dynamic environment
• Meaningful technical contributions into the development lifecycle of an application, product or service

Preferred Knowledge Experience Includes

• Understanding and development experience of embedded systems / software, and web-based applications
• Linux network device driver/data-path performance exposure
• Familiarity with compilers, debuggers, disassemblers, and other low-level development and analysis tools
• Exposure to binary analysis tools such as IDA Pro, WinDbg, BinWalk, Valgrind, PIN, Panda and S2E
• Working knowledge of hacking tools and techniques such as memory corruption exploits, rootkits, protocol poisoning, browser-based attacks, DNS poisoning, MetaSploit, nmap, Nessus, etc.
• An understanding of common cryptographic algorithms and protocols including their weaknesses and attacks against them
• Understanding of network protocols and experience developing packet-level programs
• Understanding of common microcontroller programming tools and debugging interfaces
• Exposure to Layer 2, Layer 3 networking, QoS
• Knowledge of common malware/botnet exploits and how they are targeted to exploit embedded systems
• Operating system configuration of Windows, Linux, Android, and iOS
• Computer boot process including boot loaders