Brooksource is searching for a skilled Penetration Tester to join our leading NC/SC based Healthcare client for a 6-month contract to hire. This is the ideal opportunity for someone with 5+ years of experience and a passion for continuous learning to make a big impact to a growing team.
Information Technology Services team members are responsible for securely managing information systems throughout their lifecycle, including knowing what information systems are within their scope of responsibility, understanding what sensitive data is stored, transmitted, or processed on those information systems, enforcing the security principles of least privilege and least functionality, knowing what events may constitute an information security incident, and understanding their role in security incident response activities.
The Information Security Penetration Tester conducts vulnerability assessments and determines deviations from acceptable configurations or policies. The team member also develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations.
The Information Security Penetration Tester mimics real-world attacks in order to discover methods for circumventing the security features of a health system’s application, system, or network – launching real attacks on real systems – using tools and techniques commonly used by attackers. The Information Security Penetration Tester must be adept at discovering combinations of vulnerabilities on one or more systems that can be used to gain additional access than what could be achieved through a single vulnerability.
1. Leadership: Provide oversight for the organization’s penetration testing activities. Conduct and/or support penetration testing on enterprise network and system assets. Perform technical (evaluation of technology) and non-technical (evaluation of people and process) vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, enclave boundary, and supporting infrastructure). Identify and document asset vulnerabilities.
2. Compliance: Prepare audit reports that communicate technical and procedural findings, and provide recommended remediation strategies/solutions.
3. Operational: Implement tasks under the enterprise vulnerability management program. Provide technical assistance with the configuration of information systems, incorporating the principles of least functionality and least access. Aid information system owners with the mitigation of vulnerabilities. Gather threat and vulnerability information from information sharing forums and sources.
4. Quality Improvement: Develop security penetration testing processes and for internal (and where applicable) external services. Review penetration testing results and work closely with key stakeholders to evaluate risk and develop mitigation strategies.
· Education: Bachelor’s Degree Required
· Experience: Minimum five years Information Security Penetration Testing experience
· Certifications: Certified Ethical Hacker (CEH), Licensed Penetration Tester (LPT), GIAC Penetration Tester (GPEN), Certified Penetration Tester (CPT) or equivalent
· Intermediate to advanced knowledge of penetration testing methods (i.e.; black-box, white-box).
· Intermediate to advanced knowledge of penetration testing principles, tools (e.g., metasploit, neosploit) and techniques.
· Intermediate to advanced knowledge of system and application security vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
· Intermediate to advanced knowledge of network protocols (e.g., Transmission Control Protocol/Internet Protocol [TCP/IP], Dynamic Host Configuration Protocol [DHCP]), and directory services (e.g., Domain Name System [DNS]).
· Intermediate to advanced knowledge of network traffic analysis methods. Intermediate to advanced knowledge of how traffic flows across the network (e.g., Transmission Control Protocol and Internet Protocol [TCP/IP]) and how it flows in the Open System Interconnection (OSI) model stack.
· Intermediate to advanced knowledge of packet-level analysis.
· Intermediate to advanced knowledge of web filtering technologies.
· Intermediate to advanced knowledge of host and network access control mechanisms (e.g., access control list).
· Intermediate to advanced knowledge of wireless transmission technologies (e.g., Bluetooth, Near Field [NFC] Radio Frequency Identification [RFID], Infrared Networking [IR], Wireless Fidelity [Wi-Fi]. paging, cellular).
· Intermediate to advanced knowledge of information assurance (IA) principles and organizational requirements to protect confidentiality, integrity, availability, authenticity, and non-repudiation of information and data.
· Intermediate to advanced knowledge of programming language structures and logic.
· Intermediate to advanced knowledge of cyber defense policies, procedures, and regulations. Intermediate to advanced knowledge of information security architecture principles. Intermediate to advanced knowledge of network security architecture concepts, including topology, protocols, components, and principles (e.g., application of defense-in-depth). Intermediate to advanced knowledge of incident response and handling methodologies.
· Intermediate to advanced knowledge of processes for reporting network security related incidents. Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution). Intermediate to advanced knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution). Intermediate to advanced knowledge of network security architecture concepts, including topology, protocols, components, and principles (e.g., application of defense-in-depth).
· Advanced attention to detail and organization skills. Advanced analysis and critical thinking skills. Intermediate to advanced skill in conducting vulnerability scans and recognizing vulnerabilities in security systems. Intermediate to advanced skill in assessing the robustness of security systems and designs. Intermediate to advanced skill in performing packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
· Intermediate to advanced skill in using network analysis tools to identify vulnerabilities. Intermediate interpersonal communication skill, both written and oral, with the ability to communicate effectively to technical and non-technical audiences.
· Intermediate technical writing skill. Intermediate skill with MS Office suite of tools and SharePoint.
· Ability to develop productive working relationships with business and technical groups.
· Ability to identify systemic security issues based on the analysis of vulnerability and configuration data. Ability to effectively prioritize multiple responsibilities.
· Ability to take direction as well as work with a high degree of independence.
Brooksource provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, national origin, age, sex, citizenship, disability, genetic information, gender, sexual orientation, gender identity, marital status, amnesty or status as a covered veteran in accordance with applicable federal, state, and local laws.