Security Testing Engineer

The main role is to conduct periodic Static and Dynamic tests on applications , systems, mobile applications,  and web, using different tools such as Micro Focus Fortify and Burp Suite to producing meaningful reports and presenting them to management, liaising with stakeholders in findings evaluation, validation and remediation. 

Responsibilities:

• Should have experience +5 years in information security. 
• Should have Bachelor’s degree in Computer Science, Information Systems, Cyber  Security. 
• Security, Engineering, or Equivalent
• Operate a hands-on role involving penetration testing and vulnerability assessment activities of complex applications, operating systems, and mobile applications/devices.
• Develop and maintain security testing plans.
• Conduct automated and manual penetration testing on networks, systems and applications.
• Develop meaningful metrics to reflect the true posture of the environment allowing the organization to make educated decisions based on cyber security risks.
• Produce actionable, threat-based, reports on security testing results.
• Act as a source of direction, training, and guidance for less experienced staff.
• Mentor and coach other IT security staff to provide guidance and expertise in their growth.
• Consult with application developers, systems administrators, and management to demonstrate security testing results, explain the threat presented by the results, and consult on remediations.
• Communicate security issues to a wide variety of internal and external stakeholders which include technical teams, executives, risk groups, vendors and regulators.
• Deliver the annual penetration testing schedule and developing awareness campaigns to ensure proper planning by business areas for annual tests.
• Foster and maintain relationships with key stakeholders and business partners
• Preferred has Ethical Hacking certificate. 

Technical Skills:

• Operating Systems: Kali Linux , ubuntu , Windows
• Source Code Analysis: MF Fortify (SCA), Checkmarx, Coverty, Raxis, RIPS, xssaminer, veracode, reshift .
• Exploiting Tool: Burp Suite, OWASP ZAP
• Network Scanners: Qualys Guard, Nessus, Nmap
• IP Packet Analysis: Wireshark, Ettercap, TCP Dump
• Web Application Vulnerability: Wpscan, Joomscan, Drupscan, Nessus, Nıkto, Netsparker, SQLMap, & QualysGuard
• Network Mapping Tools: NMAP, Netcat
• Web Penetration Testing Frameworks: Metasploit, Xenotix XSS exploit Framework
• Mobile Penetration Testing Frameworks: MSF (Mobile Security Framework), Appie
• Malware Analysis: Regshot, Process Explorer, Process Monitor, Hex Editor
• Forensics: Deft OS
• Scripting Languages: Basic level of PHP, Python, Bash Script