Offensive Security Analyst II-Austin or San Antonio, TX

Job Summary: As an Offensive Security Analyst II, you’ll provide consultative and hands on services by performing technical planning and testing of Digital assets, systems, processes, and employees., * Identifies and validates vulnerabilities by performing network penetration, web and mobile app testing, source code reviews, network segmentation testing, and wireless network assessments.

• Validates security control capability effectiveness by performing purple team testing using manual and automated capabilities.
• Writes and presents finding reports for both technical and executive audiences to support stakeholder remediation activities.
• Supports efforts to identify remediation solutions to security findings.
• Works with Digital Compliance, Internal Audit, business teams, and internal and external penetration testing vendors to scope, schedule, validate, and execute solutions to perform offensive testing exercises.
• Works with various first- and third-party stakeholders to plan and execute offensive testing exercises.
• Designs, develops, documents, optimizes, automates, implements Windows, Linux, virtual lab environments, virtual, and cloud solutions to support offensive simulation activities.
• Builds new offensive capabilities by designing, developing, documenting, and implementing automation, Windows, Linux, virtual lab environments, virtual, and cloud solutions.
• Research and stay up to date on emerging threats and threat emulation methodologies; maintains current knowledge of industry trends and standards; ensures continued personal growth in technology, business knowledge, and H-E-B policies and platforms.

The responsibilities and essential functions outlined above describe the general nature and level of work assigned to this position. This is not an exhaustive list of all duties, responsibilities, and skills required. Duties and responsibilities may be modified at any time based on business needs. Employees may be required to perform other job-related tasks as requested by their supervisor, subject to reasonable accommodations.

• 3+ years direct experience in areas of penetration testing (web application, host, network), exploit development, fuzzing and designing countermeasures to identified security vulnerabilities/risks
• Knowledge of attack surfaces in web technologies, networks, modern applications (microservices/containers), and operating systems; and should demonstrate the ability to analyze closed source applications using several off-the-shelf or custom developed tools
• Experience with tools such as: Kali Linux, Metasploit, Burp suite, Cobalt Strike, Tenable Nessus, Web Inspect, IDA PRO, Wireshark.
• Experience with scripting and development languages (e.g., Bash, PowerShell, Python, Perl, Ruby, PHP, C/C++, C#, Java, etc.)
• Experience with Windows, Linux and cloud environment testing.
• Working knowledge of information systems security standards/practices (e.g., access control and system hardening, system audit and log file monitoring, security policies, and incident handling).
• Must be detail-oriented and possess strong problem-solving skills and ability to analyze for potential future issues.
• Demonstrate a high level of communication skills, verbal and written.
• Experience with assessing APT threats, Penetration Testing, Vulnerability Management, attack methodologies, forensics analysis techniques, malware analysis, attack surface comprehension, Cyber Threat Emulation operations, Cyber Advanced Threat Emulation Team operations and research, identification, and/or verification of new APT TTPs.
• Fundamental understanding of security knowledge of testing mobile, native applications, web applications, distributed and database systems.

Education:

• A Bachelor’s degree

Licenses/Certifications:

• One more professional security certifications e.g -CISA, CEH, GIAC, GSEC, OSCP or CISSP