IT SOC Analyst

PARCO - Pak-Arab Refinery Limited; Karachi Division; On-site; PKR 2,000,000 - 3,000,000; Full time

Job summary

PARCO – Pak-Arab Refinery Limited is seeking an IT SOC Analyst (Contractual) to lead offensive security activities across applications, networks, and cloud environments. The role focuses on managing the Vulnerability Assessment and Vulnerability Management Program, risk-based prioritization, remediation tracking, and reporting.

The ideal candidate has a minimum 4 years of hands-on information security experience, strong reporting skills, and relevant certifications such as OSCP or CEH.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, IT, or related field.

Responsibilities

• Conduct red-team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other technology environments.
• Manage the end-to-end Vulnerability Assessment and Vulnerability Management Program, including planning, scanning, validation, remediation tracking and retesting.
• Identify, validate, and assess vulnerabilities and potential attack paths using automated tools and manual testing.
• Perform manual penetration testing of websites, services, applications, APIs, infrastructure, networks, cloud environments, IoT devices, and mobile applications.
• Coordinate with IT and other teams to ensure timely remediation of identified vulnerabilities.
• Validate remediation actions and ensure vulnerabilities are closed per risk and compliance requirements.
• Prepare technical security assessment reports, risk ratings, dashboards, and practical remediation recommendations.
• Monitor emerging vulnerabilities, exploits, threats, and attack techniques and assess their impact on the organization.
• Continuously improve security-testing methodologies, vulnerability-management processes and security controls.
• Develop scripts, tools, and methodologies to improve red-teaming, vulnerability discovery, validation, and exploitation.

Skills

Analytical skills

Report writing

Communication skills

Stakeholder management

Cross-functional teamwork

Education

Bachelor’s degree in Information Security / IT / Computer Science

Tools

Burp Suite

Nmap

Nessus

Qualys

Metasploit

Job description

Pak-Arab Refinery Limited IT SOC Analyst (Contractual)

Pak-Arab Refinery Limited (PARCO)

Pak-Arab Refinery Limited (PARCO), an integrated energy conglomerate, is a Joint Venture between Pakistan and Emirate of Abu Dhabi. PARCO owns and operates Pakistan’s most modern refinery, over 2,000 kms of pipeline network, strategic storage facilities and marketing operations. The Company has Joint Ventures with renowned international companies and is continually following an aggressive growth strategy with planned expansions, acquisitions, and penetration into new markets.

PARCO is seeking applications for the position of IT SOC Analyst (Contractual).

About The Role

The role is responsible for conducting offensive security assessments, red team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud environments, IoT devices, mobile applications, and other technology platforms. The position will also manage and continuously improve the organization’s Vulnerability Assessment/Vulnerability Management Program, ensuring effective identification, risk prioritization, remediation, validation, and closure of security vulnerabilities.

Qualification and Competencies

• Minimum Bachelor’s degree in Information Security, Computer Science, IT, or a related field.
• Strong analytical, investigative, and problem-solving capabilities.
• Ability to work effectively with cross-functional technology and business teams.
• Strong technical report-writing and communication skills.
• Ability to communicate and present security findings to both technical teams and management stakeholders.
• Strong stakeholder management and coordination capabilities.
• Relevant certifications such as OSCP, CEH, or equivalent required.

Experience

• Minimum 4 years of relevant hands-on experience in information security, offensive security, or a related field.
• Hands-on experience in red teaming, penetration testing, vulnerability assessments, and other offensive security activities.
• Experience managing or contributing to an enterprise-level Vulnerability Assessment or Vulnerability Management Program—from vulnerability identification and validation through remediation and closure.
• Experience in risk-based vulnerability prioritization, remediation tracking, validation, and management reporting.
• Experience conducting security testing of Web applications and services, APIs, Networks and infrastructure, Cloud environments, Mobile applications, IoT devices, and other technology environments.
• Experience working with cross-functional technology and business teams to address identified security risks.
• Experience preparing security assessment reports and presenting findings to technical and management stakeholders.
• Candidates with experience in the following industries will be preferred:
• Oil and Gas
• Banking and Financial Services
• Telecommunications
• Technology and IT Services
• Critical Infrastructure
• Other highly regulated or security-sensitive industries

Job Responsibilities

• Conduct red-team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other technology environments.
• Manage the end-to-end Vulnerability Assessment and Vulnerability Management Program, including, Planning and scheduling, Vulnerability scanning, Assessment and validation, Risk-based prioritization, Remediation tracking and Retesting and closure validation.
• Identify, validate, and assess vulnerabilities and potential attack paths using automated tools and manual testing techniques.
• Perform manual penetration testing of websites, services, applications, APIs, infrastructure, networks, cloud environments, IoT devices, and mobile applications to discover and exploit vulnerabilities.
• Coordinate with IT, infrastructure, application, and other relevant teams to ensure timely remediation of identified vulnerabilities.
• Validate completed remediation actions and ensure vulnerabilities are closed in accordance with defined risk and compliance requirements.
• Prepare technical security assessment reports, risk ratings, management dashboards, and practical remediation recommendations.
• Monitor emerging vulnerabilities, exploits, threats, and attack techniques and assess their potential impact on the organization.
• Continuously improve security-testing methodologies, vulnerability-management processes, offensive-security capabilities, and related security controls.
• Develop scripts, tools, and methodologies to improve and automate red-teaming, vulnerability discovery, validation, and exploitation activities.

Specific Skills

• Strong hands-on skills in red teaming, penetration testing, vulnerability assessment, and offensive security.
• Ability to manage an enterprise-level Vulnerability Assessment and Vulnerability Management Program.
• Proficiency with security-testing tools such as Burp Suite, Nmap, Nessus or Qualys, Metasploit or any other equivalent vulnerability assessment and penetration-testing tools.
• Strong knowledge of:
• OWASP Top 10
• Web & mobile application and API security
• Network and infrastructure security
• Cloud security testing
• Active Directory security
• Windows and Linux environments
• Authentication and authorization weaknesses
• Privilege-escalation techniques
• Common exploitation techniques and attack paths
• Ability to distinguish false positives from genuine vulnerabilities and manually validate security findings.
• Good understanding of risk-based vulnerability prioritization, remediation management, and closure requirements.
• Ability to develop scripts and tools for automating vulnerability discovery or exploitation using Bash, Python, JavaScript, or similar languages.
• Strong technical documentation, report-writing, communication, presentation, and stakeholder-management skills.

Location

Corporate Headquarters – Karachi

PARCO is an equal opportunity employer. We value diversity and encourage candidates from all backgrounds to apply. Our commitment to a conducive work environment is designed to attract and nurture top talent.