Key Job Responsibilities and Duties

• Drive a complete, end-to-end threat led offensive security program that includes internally and externally performed purple teams, red teams, attack path maps and full stack penetration tests.

• Define assessment scope and objectives that are aligned with the business needs and guide the team to execute realistic offensive security exercises to simulate real attacks, to test and improve our detection and response capabilities, and to identify how attackers could infiltrate and move inside our infrastructure.

• Create scenarios that advanced attackers might use to compromise our security defenses and guide the team to emulate both the techniques used by known threat actors and create new techniques that attackers might attempt in the future.

• Work closely with other security, product and infrastructure teams to design defense-in-depth controls that limit attackers' ability to move inside our network.

• Review comprehensive assessment reports and findings produced by your team and the vendor that are technical and managerial to describe the engagement, scope, risks, and remediation recommendations.

• Ensure the organization’s compliance with regulatory requirements by delivering the services that are in offensive security scope.

• Liaison between technical teams and executive level professionals to relay relevant testing results and findings.

• Design and develop offensive security policies, standards, and procedures.

• Work with the Threat Management Capability Area Manager to understand business expectations, key initiatives, and set meaningful yearly goals for the Offensive Security Team.

• Ensure that Offensive Security is actively, timely and appropriately involved to support product Go-Live, incident management, response and recovery.

• Perpetually strengthen relevant skills, knowledge, and abilities to stay at the forefront of the information security industry.

People Management

• Being an offensive security tech manager but also a manager of a team of up to 6 FTEs.

• Lead a multi-disciplined, cross-functional in-house and vendor teams (consisting of penetration testers and contractors) to achieve departmental and capability objectives.

• Lead and support the delivery of offensive security assessments for new and key existing products, systems and networks by mentoring and motivating the responsible team members and by maintaining an effective workload balance within the team.

• Drive continuous improvements and operational efficiency in the Offensive Security Team, supporting the appropriate resourcing and budgeting allocation to each area of focus and ensuring that the organization and people are set up to deliver.

• Provide technical and administrative oversight and guidance to junior members of the team while performing technical operations.

• Mentor team members and support their development with personal development plans.

Role Qualifications and Requirements

• 8+ years of experience in the security domain, and exposure to a variety of threat-related areas, especially in the field of offensive security and preferably also in other areas such as threat analysis and threat intelligence.

• 5+ years of experience performing offensive/attack-oriented security assessments.

• 3+ years of people management experience.

• Knowledge of standards and frameworks such as NIST, PCI, SOX, ITIL and GDPR, DMA, DSA.

• Knowledge of security testing frameworks and standards such as OSSTMM, OWASP, NIST SP 800-115, and MITRE ATT&CK.

• Experience in creating a vision and authoring the design of cyber programs and methodologies.

• Experience of creating development plans for teams and nurturing talent.

• Hands-on experience of implementing AI technologies for offensive security work.

Preferred:

• Cyber Security Certification is a plus (e.g. CISM, CISSP, etc).

• Experience of automation, orchestration, and scripting to reduce manual processes, improving overall efficiency while also enabling new capabilities to meet the rapidly changing needs of our clients.

• Mastery of commercial and open source security tools including, but not limited to: Nessus, BurpSuite, Cobalt Strike, Metasploit, Kali Linux, Qualys, AppScan, Veracode, Checkmarx, SysDig.

• Knowledge of defensive tactics designed to counter offensive cyber operations.

• Other lab-based certifications such as OSCP, OSCE, GIAC, and GSE are preferred.

• Experience building/automating Red Team Infrastructure.

• BA/BS Degree ideally in Computer Science, Cyber Security, Information Security, Engineering or Information Technology.

• Excellent writing and verbal communication skills.

• Strong project management and organizational skills.