Penetration Testing Specialist

Penetration Testing Specialist at Positive Technologies. Remote. Salary discussed at interview. RedTeam, continuous pentesting, infrastructure compromise.

What you will do: • Participation in risk verification (aka APT emulation) — comprehensive work where, in addition to pentester skills in infrastructure compromise, you need to demonstrate achievement of declared business risks, often under active counteraction from the customer's BlueTeam, i.e. RedTeam format work. Business risks include the most critical systems for an organization — for example, ICS/SCADA if the customer is an industrial enterprise, or SWIFT and APM KBR if the customer is a bank; • Pentest365 (aka continuous penetration testing) — continuous and long-term (usually a year-long service) identification of vulnerabilities (including trending vulnerabilities) in the customer's infrastructure, with periodic tracking of changes on the customer's external perimeter and constant analysis of old and newly appeared services for vulnerabilities; • Conducting comprehensive (external and internal) testing of companies — from collecting the external perimeter scope and finding vectors for breakthrough to obtaining maximum privileges in the internal infrastructure (usually Active Directory domain); • Conducting wireless network security analysis; • Conducting social engineering work.

• Experience in information security; • Theoretical and practical experience in finding and exploiting various web vulnerabilities, knowledge of their features and different exploitation vectors; • Ability to perform white-box vulnerability search, read code in one or more languages: C#, Java, Node.js, PHP, Python, Ruby; • Experience in Active Directory compromise; • Understanding of TTP RedTeam projects; • Programming and automation skills; • Desire for professional development.

Remote work. Salary: RUB, discussed at interview.