IT SOC Analyst

PARCO; Karachi Division; Sur place; PKR 2 000 000 - 3 600 000; Plein temps

Résumé du poste

Pak-Arab Refinery Limited (PARCO) is seeking an IT SOC Analyst on a contractual basis to lead offensive security assessments, red team exercises, and vulnerability management across applications, networks, cloud, and IoT. You will drive risk-based remediation, develop reports, and present findings to technical and management stakeholders.

The role requires hands-on testing, risk prioritization, and continuous improvement of security controls.

Qualifications

• Bachelor’s degree in information security, CS, IT, or related field.
• Strong analytical and problem-solving capabilities.
• Ability to collaborate with cross-functional teams.
• Strong technical report-writing and communication skills.
• Ability to present security findings to technical and management stakeholders.
• Strong stakeholder management and coordination capabilities.
• Certifications such as OSCP, CEH, or equivalent.

Responsabilités

• Conduct red-team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other tech environments.
• Manage end-to-end Vulnerability Assessment and Vulnerability Management Program including planning, scanning, assessment, remediation, validation, and closure.
• Identify, validate, and assess vulnerabilities using automated tools and manual testing techniques.
• Perform manual penetration testing of websites, services, apps, APIs, infrastructure, and mobile apps to discover vulnerabilities.
• Coordinate with IT and other teams to ensure timely remediation of identified vulnerabilities.
• Validate remediation actions and ensure closures per risk and compliance requirements.
• Prepare technical security assessment reports, risk ratings, dashboards, and remediation recommendations.
• Monitor emerging vulnerabilities and attack techniques and assess their impact.

Connaissances

Red teaming

Penetration testing

Vulnerability assessment

Security testing

Report writing

Stakeholder communication

Formation

Bachelor’s degree

Outils

Burp Suite

Nmap

Nessus/Qualys

Metasploit

Description du poste

Pak-Arab Refinery Limited (PARCO), an integrated energy conglomerate, is a Joint Venture between Pakistan and Emirate of Abu Dhabi. PARCO owns and operates Pakistan’s most modern refinery, over 2,000 kms of pipeline network, strategic storage facilities and marketing operations. The Company has Joint Ventures with renowned international companies and is continually following an aggressive growth strategy with planned expansions, acquisitions, and penetration into new markets.

PARCO is seeking applications for the position ofIT SOC Analyst (Contractual).

About the Role

The role is responsible for conducting offensive security assessments, red team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud environments, IoT devices, mobile applications, and other technology platforms. The position will also manage and continuously improve the organization’s Vulnerability Assessment/Vulnerability Management Program, ensuring effective identification, risk prioritization, remediation, validation, and closure of security vulnerabilities.

Qualification and Competencies

• Minimum Bachelor’s degree in Information Security, Computer Science, IT, or a related field.
• Strong analytical, investigative, and problem-solving capabilities.
• Ability to work effectively with cross-functional technology and business teams.
• Strong technical report-writing and communication skills.
• Ability to communicate and present security findings to both technical teams and management stakeholders.
• Strong stakeholder management and coordination capabilities.
• Relevant certifications such as OSCP, CEH, or equivalent required.

Experience

• Minimum 4 years of relevant hands-on experience in information security, offensive security, or a related field.
• Hands-on experience in red teaming, penetration testing, vulnerability assessments, and other offensive security activities.
• Experience managing or contributing to an enterprise-level Vulnerability Assessment or Vulnerability Management Program—from vulnerability identification and validation through remediation and closure.
• Experience in risk-based vulnerability prioritization, remediation tracking, validation, and management reporting.Experience conducting security testing of Web applications and services, APIs, Networks and infrastructure, Cloud environments, Mobile applications, IoT devices, and other technology environments.
• Experience working with cross‑functional technology and business teams to address identified security risks.
• Experience preparing security assessment reports and presenting findings to technical and management stakeholders.
• Candidates with experience in the following industries will be preferred:
• Oil and Gas
• Banking and Financial Services
• Telecommunications
• Technology and IT Services
• Critical Infrastructure
• Other highly regulated or security-sensitive industries

Job Responsibilities

• Conduct red-team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other technology environments.
• Manage the end-to-end Vulnerability Assessment and Vulnerability Management Program, including, Planning and scheduling, Vulnerability scanning, Assessment and validation, Risk-based prioritization, Remediation tracking and Retesting and closure validation.
• Identify, validate, and assess vulnerabilities and potential attack paths using automated tools and manual testing techniques.
• Perform manual penetration testing of websites, services, applications, APIs, infrastructure, networks, cloud environments, IoT devices, and mobile applications to discover and exploit vulnerabilities.
• Coordinate with IT, infrastructure, application, and other relevant teams to ensure timely remediation of identified vulnerabilities.
• Validate completed remediation actions and ensure vulnerabilities are closed in accordance with defined risk and compliance requirements.
• Prepare technical security assessment reports, risk ratings, management dashboards, and practical remediation recommendations.
• Monitor emerging vulnerabilities, exploits, threats, and attack techniques and assess their potential impact on the organization.
• Continuously improve security-testing methodologies, vulnerability-management processes, offensive-security capabilities, and related security controls.
• Develop scripts, tools, and methodologies to improve and automate red-teaming, vulnerability discovery, validation, and exploitation activities.

Specific Skills

• Strong hands-on skills in red teaming, penetration testing, vulnerability assessment, and offensive security.
• Ability to manage an enterprise-level Vulnerability Assessment and Vulnerability Management Program.
• Proficiency with security-testing tools such as Burp Suite, Nmap, Nessus or Qualys, Metasploit or any other equivalent vulnerability assessment and penetration-testing tools.
• Strong knowledge of:
• OWASP Top 10
• Web & mobile application and API security
• Network and infrastructure security
• Cloud security testing
• Active Directory security
• Windows and Linux environments
• Authentication and authorization weaknesses
• Common exploitation techniques and attack paths
• Ability to distinguish false positives from genuine vulnerabilities and manually validate security findings.
• Good understanding of risk-based vulnerability prioritization, remediation management, and closure requirements.
• Strong technical documentation, report-writing, communication, presentation, and stakeholder-management skills.

PARCO is an equal opportunity employer. We value diversity and encourage candidates from all backgrounds to apply. Our commitment to a conducive work environment is designed to attract and nurture top talent.