Senior Penetration Testing Engineer

Firm: Financial technology company that provides access to alternative investment opportunities, such as private equity and hedge funds, primarily for wealth managers, advisors, and their clients. The platform simplifies the investment process, offering tools for due diligence, investment management, and reporting. By leveraging technology, FIRM aims to democratize access to alternative investments, making them more accessible to a wider range of investors.

In office locations:

• New York, NY
• San Antonio. TX
• Irvine, CA

Employment:          Full time

IN OFFICE:           3 days a week.

Comp:

• Southern California Base Salary Range: $148,045-$236,872 + Bonus 15% + retirement pkg.
• ‎San Antonio Base Salary Range: $121,706-$194,730 + Bonus 15% + retirement pkg.
• ‎New York Base Salary Range: $156,935-$251,096 + Bonus 15% + retirement pkg.

From CISO:

“I am looking for an SME in Penetration Testing Tracey, not someone that is doing this with other responsibilities. This is a professional that is 100% focused on Pen Testing ( Cloud, Web, extremely strong Script/coding ). We are building out the Pen Testing side of our team and this member will be our lead. Ideally, I would like someone certified in OSCP or OSCE but willing to let that go if the candidate can show they have appropriate skills and experience.”

“I can succeed as a Senior Penetration Testing Engineer at Hedge Fund”:

As the Senior Penetration Testing Engineer, you are an individual contributor in the Hedge Fund (CG) AppSec / Penetration Testing team.  The CG AppSec team is part of Information Security in CG’s Information Technology Group.  In the role you will be performing web application and network penetration tests, code reviews, security design reviews, red/purple team assessments, and providing security signoffs for technology initiatives.  You will be discovering security issues across web applications, native applications and other systems through threat modeling, code reviews (Java, TypeScript/JavaScript, Python), and dynamic application testing.  As the Senior Penetration Testing Engineer, you will also be responsible for performing red and purple team assessments for Hedge Fund’s detective security controls.  The team members are geographically dispersed with varying experience levels. As the senior member on the team, you will be creating proof-of-concept exploits for the security issues discovered.  You will be responsible for coordinating and communicating with the key technology stakeholders for delivery of security assessments and explaining technology risks and mitigations.  This role is hybrid (in-office 3 days/week) and can be in Irvine CA, San Antonio TX, or New York NY depending on candidate current location and/or preference.

In addition, you will be responsible for:

• Conducting Comprehensive Security Assessments: Perform in-depth penetration tests, infrastructure vulnerability assessments, and application security assessments to identify weaknesses and potential attack vectors.
• Executing Tests/Assessments: Plan and execute penetration testing activities using a variety of tools (SAST, DAST, SCA tools) and techniques, including network scanning and web application testing.
• Analyzing and Reporting Findings: Analyze test results and prepare detailed reports documenting identified vulnerabilities, their potential impact, and recommended remediation actions.
• Collaborating with Stakeholders: Work closely with cross-functional teams across technology, infrastructure, business including developers, system administrators, and business stakeholders, to prioritize and address security findings. You will be expected to communicate effectively and have an empathetic outlook towards development teams by authoring clear, actionable guidance on writing secure code.
• Staying Abreast of Emerging Threats: Keep up to date with the latest security trends, vulnerabilities, and attack techniques to continuously improve testing methodologies and stay ahead of potential threats. Be an active advocate to software development teams in educating them on secure software development methodologies.
• Develop automated proof-of-concepts, and automated security tests by authoring security testing tools.
• Execute red and purple team tests of detective tooling including EDR tools, security telemetry tools, anti-virus software, having knowledge of MITRE ATT&CK Framework (Cloud, macOS, Windows, Linux), AI-based software systems.
• Develop, organize and lead the Capture-the-Flag (CTF) competitions and be an active participant in such competitions.

“I am the person Hedge Fund is looking for.”

• You have a bachelor’s degree in computer science, a related field, or equivalent experience.
• You have a minimum of 5 years of experience in Penetration Testing, Red Team or Application Security
• You have a strong understanding of network security, TCP/IP, DNS, TLS, HTTP, IPSec, 802.11, etc.
• You have experience with security protocols and/or technologies such as REST APIs, Burp Suite, ZAP, Kali Linux, Windows, macOS, Nmap, Metasploit, Powersploit, Lolbins, etc.
• You can automate tasks in Python, bash, Java, C/C#/C++, Rust, etc.
• You have a strong understanding of attacks in AWS, Azure, GCP, OAuth, websockets, etc.
• You have professional certifications such as Offensive Security Certified Professional (OSCP), OffSec Certified Expert (OSCE) or GIAC Penetration Tester (GPEN) preferred.
• Strong knowledge of common security vulnerabilities, attack vectors, and exploitation techniques.
• You have excellent communication skills (written, oral), with the ability to simplify and document complex technical details to both technical and non-technical audiences.
• You can learn quickly and have a track record of developing a deep understanding of systems and risks to the business.
• You have experience coaching and working with engineers to build security and privacy by design.
• You have experience performing application design, threat detection, incident response, patching, vulnerability remediation, secure development training, and user training.
• You have experience using secure development frameworks (i.e.. OWASP Top 10, SANS Top 25 and Microsoft SDL).
• You are proficient in bypassing and tuning security technologies (i.e.. Anti-Malware, IDS, DLP, FIM, Firewalls, SIEM, MFA, Web Proxies and WAF).
• You have familiarity with AWS security best practices and Infrastructure-as-Code.
• You can work independently, collaboratively and take the initiative to drive security initiatives forward.
• You can manage multiple tasks and coordinate/delegate to achieve speedy resolutions to application security-related security incidents working with stakeholders globally.
• You have strong analytical and problem-solving abilities, with a keen attention to detail.