- Working knowledge of common operating systems and domain structures (Windows, Linux, Active Directory, etc.), servers, services, and associated vulnerabilities.
- Working knowledge of scripting languages (e.g., PowerShell, Python, JavaScript, etc.) and/or programming languages (e.g., C, Java, C#)
- Demonstrable experience with security tools such as Responder, Impacket, BloodHound, Sysinternals Suite, OS native (i.e., LOL binaries), and C2 frameworks.
- Knowledge of frameworks such as MITRE ATT&CK, MITRE D3FEND, OWASP, and NIST CSF.
- Deep knowledge of common vulnerabilities and exploits, adversarial methodologies, and tactics.
- Ability to understand and communicate technical recommendations around mitigation and detection of discovered risks.
- Strong verbal and written communication skills, organizational skills, and attention to detail.
- Strong presentation skills.
- Prior experience in a client-facing role as a consultant.
- Demonstrate ownership of projects and tasks and a sense of urgency in completing assigned activities.
- Ability to work collaboratively and professionally with co-workers, clients, and management.
- Ability to be flexible and embrace change.
- Ability to manage multiple tasks and responsibilities, work alone or in small teams, achieve established goals and objectives, and communicate progress in a timely and meaningful manner.
- Must possess one of the following certifications: OSCP, GPEN, GXPN, GCPN, CCSP, or CRTO.
Additional Desired Skills: - ?Perform both authenticated and unauthenticated web application testing as well as API assessments (RESTful and SOAP).
- Familiarity with PlexTrac, Burp Suite, Postman, Swagger, Tailscale
- Mobile application penetration testing experience (iOS and Android).
- Physical penetration testing experience.
- Social Engineering experience (phishing campaigns, impersonation, vishing, smishing)
- Background in web application development and/or cloud computing is strongly preferred.
- Security training focused on penetration testing, web applications testing, cloud security, or red teaming.
- Industry certifications such as CASP+ CE, CCISO, CCNA Cyber Ops, CCNA, CCNP Security, CEH, CFR, CISA, CISM, CISSP, Cloud+, CySA+, GCED, GCIA, GCIH, GICSP, or GSLC.
- Strong cross-functional team participant and collaborative approach to problem-solving.
- Self-starter with the ability to manage their tasks in a larger project or program effort.
Education and Experience: - Bachelor's degree or equivalent experience and/or military experience
- 5+ years’ experience conducting penetration tests, web application assessments, or other high-level technical testing.
|
