Attack Surface Management Senior Consultant

Job Description

Work youll doAs an Attack Surface Management Senior Consultant, you will assist our clients with discovering vulnerabilities and rogue assets (such as shadow IT) in their networks as part of a team of engineers and analysts around the world who specialize in the tactics, tools and procedures used by cyber criminals.1. Configure and execute vulnerability scans enumerating vulnerabilities within the internal and external network2. Analyze, enrich, and prioritize specific activities designed to remediate discovered vulnerabilities such as patch deployment or configuration hardening3. Assist in producing a comprehensive operating picture and cyber security situational awareness4. Work with various vulnerability threat feeds (such as vendor bulletins), assessment tools, asset inventory tools as well as reporting tools and frameworks to match assets to identified vulnerabilities and produce reports5. Respond to requests for ad-hoc reporting and research topics from management and analysts as required6. Identify gaps in available asset information and engage with leadership on strategies to meet service-level requirements through affirmative handoff with remediation partners7. Quickly understand and deliver on company and customer requirements8. Aid in and participate in daily, weekly, quarterly, and yearly reporting for clients, partners, and internal teams9. Adhere to internal operational security and policiesQualifications Required:1. Bachelors degree or higher in Attack Surface Management, Information Security, Information Technology, Computer Science, Math, or any other related area2. 3-7 years of experience working in information technology vulnerability management, information security, incident response, red team operations, application security, reverse engineering, or other technical cyber security roles3. Certified Information Systems Security Professional (CISSP), Certification in Certified Intrusion Analyst (GIAC), Continuous Monitoring (GMON), Certified Ethical Hacker (CEH) or equivalent4. Understanding of possible attack activities such as network probing/ scanning, DDOS, malicious code activity, etc.5. Understanding of common network infrastructure devices such as routers and switches6. Understanding of basic networking protocols such as TCP/IP, DNS, HTTP7. Understanding of vulnerability classification using National Vulnerability Database nomenclature such as CVE/CVSS8. Basic knowledge in system security architecture and security solutionsPreferred:1. Proven ability to translate complex information sets into specific recommendations that can be actioned by customers to enhance their security posture2. Familiarity with cyber threats, defenses, motivations, and techniques3. Experience with vulnerability analysis tools such as Qualys or Tenable, and theasset provisioning/deprovisioning lifecycle4. Patch management skills and technology application such as Microsoft System Center Configuration Manager (SCCM)5. Experience distilling raw information into actionable intelligence6. Outstanding English written and oral communication skills and the ability to prioritize work7. Strong understanding of threat analysis and enterprise level, mitigation strategies8. Working knowledge of how malicious code operates and how technical vulnerabilities are exploited9. Strong knowledge of operating systems and networking technologies in general10. Strong knowledge of databases, query design, and how to analyze data thus obtained11. Knowledge of supporting toolsets such as Confluence, Jira, and Configuration Management Databases (CMDB) such as ServiceNow12. Strong analytical and problem-solving skills13. Self-motivated to improve knowledge and skills14. A strong desire to understand the what as well as the why and the how of security incidents

Keyskills :
attack penetrationconsulting