Senior Penetration Tester - Costco Wholesale Issaquah, WA, USA Bookmark Share Print 589 0 1

Listing Description

*This position will be on-site 3 days a week starting August 1st*

Penetration testers provide consultative services ; working with internal business team members to conduct service engagements for security testing. Penetration perform reviews of system architecture documentation; creation of the scope of work for an engagement, conduct security testing engagements on scoped assets, systems, processes, and/or employees; mentor other team members with lesser subject matter expertise.

If you want to be a part of one of the BEST “to work for” companies in the world, simply apply and let your career be reimagined.

ROLE

• Works with Compliance, Internal Audit, and Business teams to identify, test and analyze risks.
• Works with stakeholders to provide security engagements to test their systems and business requirements.
• Assumes a leadership role in advocating internally and externally for compliance to security measures to protect cloud-based applications and environments.
• Documents security findings fro m penetration testing engagements and reports the risks of those findings to the business owner and management.
• Finds vulnerabilities in various spaces such as web applications, native applications, database systems, authentication flows, distributed systems and designs, and protocols. Pulling from a flexible knowledgebase of topics such as OWASP, memory corruption, privilege escalation, networking, and etc. to find both common and uncommon issues.
• Researches and remains up to date with emerging threats and Threat Emulation methodologies.
• Clearly communicates Information Security matters to executives, auditors, end users, and engineers, using appropriate language, examples, and tone.
• Works collaboratively to solve problems with groups, find win/win solutions and celebrate successes
• Works with Incident Response team as necessary to consult on discovered security incidents by informing appropriate custodians, determining root cause, and actions (if necessary) required to re-establish respective information system security.
• Leads comprehensive assessments of features and large-scale applications and environments. This includes mapping out the surface area and assessing prioritization based on time, resource, and general importance tradeoffs.
• Navigates through an ecosystem of multiple domains, technologies, protocols, and stakeholders.
• Creates new tools to support pen tests efforts.
• Provides subject matter expertise support in the detection, analysis, and mitigation of malware, trends in malware development and capabilities, and proficiency with malware analysis capabilities.
• Participates in team activities and team planning in regards to improving team skills, awareness and quality of work.
• Responsible for continued personal growth in the areas of technology, business knowledge, and Costco policies and platforms.

REQUIRED

• 5+ years’ required experience with assessing APT threats, Penetration Testing, Vulnerability Management, attack methodologies, forensics analysis techniques, malware analysis, attack surface comprehension, Cyber Threat Emulation operations, Cyber Advanced Threat Emulation Team operations and research, identification, and verification of new APT TTPs.
• Proven operational experience in penetration testing or cyber threat emulation.
• Experience and security knowledge around native applications, web applications, distributed and database systems.
• Proficiency in programming and scripting languages (C/C++, Ruby, dotnet, js, python, sql, Powershell, others) with expertise in troubleshooting and debugging skills.
• Exposure or experience with tools such as; Kali Linux, Metasploit, Burp suite, Cobalt Strike, Tenable Nessus, Web Inspect, IDA PRO.
• Ramps up and understands new designs, systems, and technology.
• Understands security issues for large scale cloud services and network infrastructures.
• Understands software development processes and hybrid-cloud based infrastructure.
• Thorough experience within both Windows, Linux and cloud environment testing.
• Experience developing custom exploits and exploitation tools in support of authorized penetration tests or cyber threat emulation exercises.
• Expertise in policies, industry trends, and techniques related to penetration testing.
• Existing Subject Matter Expert of Advanced Persistent Threat or Emerging Threats.
• Grasps both the technical and non-technical details such as to enumerate inappropriate or abusable security expectations.
• Demonstrates a logical and structured approach to time management and task prioritization.
• Strong proficiency Report writing.
• Ability to handle highly confidential information in a strictly professional manner.
• Willingness to work outside of regular business hours, as required.
• Willingness to travel as required to conduct testing engagements.
• High enthusiasm, integrity, ingenuity, results-orientation, self-motivation, and resourcefulness in a fast-paced environment.
• Must be available most of the time to work outside of regular business hours.
• Travel is required for pen test engagements when needed post-Covid.

Recommended

• A relevant degree.
• One or more certifications for penetration testing: GCIA, GCED, GCFE, GCTI, GNFA, GCIH, CND, ECSA, OSCP, OSEE, OSCE, GCFA, GREM, CHFI, CEH, GPEN, GWAPT, GISF, GXPN.
• Red Teaming including, leading a targeted operation (planning, scoping, approval, reconnaissance & discovery, execution of attacks, pivoting, persistence, and remediation).