Penetration Tester / Red Team Analyst

Bwcyberservices; Raleigh (NC); On-site; USD 85,000 - 120,000; Full time

Job summary

Bwcyberservices in Raleigh, NC is seeking a security professional to emulate adversary TTPs to validate controls and develop engagement rules. You will brief clients on findings and remediation techniques while coordinating testing requests and monitoring progress.

Responsibilities include vulnerability assessments, web app and phishing campaigns, wireless/security reviews, and producing detailed reports and executive summaries for IT staff and executives.

Qualifications

• Bachelor's degree or higher required.
• 3-5 years in penetration testing or incident response.
• Active certifications: GXPN, OSCE, OSCP, OSEE or equivalent experience with APT incidents.

Responsibilities

• Perform technical security assessments across client environments (Vuln, Web app, Wireless, Social engineering, Public Cloud).
• Develop rules of engagement and configure assessment tools.
• Coordinate, schedule, and support security testing requests.
• Evaluate findings for applicability, saturation, and impact.
• Produce detailed technical reports and executive summaries for clients.

Skills

Exploit development scripting

PowerShell

Python

Ruby

Perl

Education

Bachelor's degree

Tools

Nessus

OpenVAS

Qualys

Metasploit

Burp Suite

ZAP

Job description

Overview

Emulate adversary tactics, techniques, and procedures (TTPs) to validate security controls effectiveness;develop rules of engagement, brief clients on findings and mitigation techniques

Key Responsibilities

• Perform technical security assessments of client environments which include (non-exclusive):o Vulnerability Assessmentso Web Application Testso Wireless Security Testso Social Engineering Campaigns (phishing, spearphishing, and pretexting) o Public Cloud Hygiene Reviews
• Develop rules of engagement, and configure, tune, and operate industry standard assessment tools
• Coordinate, schedule, and support security testing requests
• Evaluate findings to determine applicability, saturation, and potential impact
• Analyze results and produce reports for clientso Detailed technical reports for IT staffo High-level summary presentations for executives
• Advise client stakeholders of findings and provide remediation guidance
• As appropriate, monitor remediation efforts of findings and communicate progress to stakeholders
• As appropriate, work with client stakeholders to develop Plan of Action & Milestones (POA&M) tracker to ensure identified weaknesses are addressed in a timely and cost-effective manner
• As needed, assist in cyber incident response for clients

Desired Skills

• Expertise creating exploits for vulnerabilities or demonstrated expertise using a scripting language such as PowerShell, Python, Ruby, or Perl for penetration testing or incident response
• Expert in common vulnerability scanners, e.g. Nessus, OpenVAS, Qualys
• Expert in common penetration testing tools, e.g. Metasploit, Burp, ZAP

Experience Required

• Bachelor's degree or higher
• 3-5 years of experience in penetration testing or incident response
• One of the following active certifications: Exploit Researcher and Advanced Penetration Tester (GXPN), Offensive Security Certified Expert (OSCE), Offensive Security Certified Professional (OSCP), Offensive Security Exploitation Expert (OSEE) or one or more years' experience responding to Advanced Persistent Threat (APT) type incidents

Desired Location: Raleigh, NC