Security Vulnerability and Penetration Testing Engineer

Executive Mandate Specification

The Security Vulnerability and Penetration Testing (VAPT) Engineer will oversee and serve as a technical resource for all assessment activity related to the security posture of existing and proposed firm systems, platforms, and processes to protect and continually improve the confidentiality, integrity, and availability of information systems per the firm's business objectives, regulatory requirements, and strategic goals.

Responsibilities:

• Perform security penetration testing of firms systems, platforms, and applications
• Serve as a Subject Matter Expert (SME) for the VAPT function
• Serve as the system owner for common VAPT toolsets, platforms, and processes
• Provide technical assessment reports that are easily understandable by the target audience and include practical and reasonable recommendations based upon sound risk management principles

Skills and Experience:

• Commanding knowledge of VAPT concepts and best practices, including the requirements for WhiteHat/ethical hacking
• Expert understanding of the difference between a vulnerability assessment and a penetration test in the context of assessment scope, objectives, and deliverables
• Extensive experience with common automated VAPT tools such as Nessus, Appscan, Burp Suite, Nipper, and Trustwave
• Expertise with common attack tools and frameworks such as Wireshark, Kali, Metasploit, etc.
• Expertise with mobile platform security technology, including vulnerability identification and exploitation tools as well as mobile platform security best practices, frameworks, etc.
• Ability to validate the presence of identified vulnerabilities with accuracy
• Mastery of common application platforms and technologies to effectively understand and evaluate complex application assessments via the use of manual techniques and simple tools such as proxies and browser plugins
• Authoritative mastery of OWASP, CVE, general security controls, and other foundational topics such as the latest application and operating system exploits
• Expert knowledge of common scripting and programming languages is advantageous
• Ongoing commitment to understanding the threat landscape and common adversary motivations/practices. Ability to quickly adapt practices to evolving circumstances
• Ability to maintain critical thinking and composure under pressure
• Strong written and oral communication skills. Ability to convey complex concepts to non-technical constituents. Proficiency in oral and written English
• Capable of assisting with the preparation of internal training materials and documentation
• Ability to be productive and maintain focus without direct supervision
• Understands VAPT in the context of risk management and organizational priorities
• Passionate in the practice and pursuit of VAPT excellence
• Possess a Computer Science Bachelor’s Degree or substantially equivalent experience
• CISSP required

Interested applicants may also apply via Career Opportunities (bakermckenzie.com)

Job Type: Full-time

Application question(s):

• Will you now or in the future require sponsorship for employment visa status?

Work authorisation:

• United Kingdom (required)

Work Location: In person

Statutory Executive Benefits & Governance

• Executive Health, Vision & Dental Coverage with Global Provider Options
• Corporate Pension Auto-Enrolment / 401(k) Retirement Plan with Fiduciary Matching
• Annual Discretionary Performance Incentive & Long-Term Equity Participation
• Executive Leave Allotment, Statutory Holidays & Dedicated Health Care Reserves
• US Department of Labor & E-Verify Work Authorization Sponsorship