VAPT Engineer  

Purpose

To accomplish all assigned tasks by the management in a timely and effective manner as deemed necessary for the betterment of the organization as a whole.

Duties and Responsibilities

• Prepare audit reports that identify technical and procedural findings and provide recommended remediation strategies/solutions.
• Perform technical (evaluation of technology) and nontechnical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications).
• Conduct and/or support authorized penetration testing on enterprise network assets.
• Conduct required reviews as appropriate within environment.
• Make recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes).
• Participate and collaborate in Knowledge Transfers within the VAPT Team.

Working Conditions

• Probationary for 6 months
• Personal and professional development (certified training, on-the-job coaching & mentoring, career progression support)

A. Minimum Education

• College Graduate or Diploma holder of any computer-related course.
• Preferably a degree in Information Technology, Engineering, or a related field.

B. Minimum Experience/Training

• 2 years+ experience working in Vulnerability Assessment and Penetration Testing, Red Teaming
• Knowledge of ITIL, Infrastructure related technologies & understanding of business relevance of the technologies
• Experience working with IT systems and software such as Tenable IO, Nessus, Kali, Parrot, etc.

C. Competency

• Ability to collaborate with team members.
• Ability to analyze a high volume of technical data and work in a fast-paced environment.
• Strong problem solving, analytical, and time management skills.
• Positive, energetic, enthusiastic attitude
• Strong attention to detail
• ·Excellent at multi-tasking & task prioritization
• Self-motivated, proactive, and customer-centric attitude
• Quick learner and willing to adapt to a dynamic working environment
• Ability to apply judgement in high pressure situations with minimal external guidance
• Knowledge of cybersecurity and privacy principles.
• Knowledge of computer networking concepts and protocols, and network security methodologies.
• Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
• Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
• Knowledge of cyber threats and vulnerabilities.
• Knowledge of specific operational impacts of cybersecurity lapses.
• Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
• Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).
• Knowledge of application vulnerabilities.
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
• Knowledge of what constitutes a network attack and a network attack’s relationship to both threats and vulnerabilities.
• Knowledge of penetration testing principles, tools, and techniques.
• Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
• Skill in the use of penetration testing tools and techniques.
• Skill in using network analysis tools to identify vulnerabilities. (e.g.,fuzzing, nmap, etc.).
• Skill in conducting application vulnerability assessments.
• Knowledge of data backup and recovery.
• Knowledge of data backup and restoration concepts.
• Knowledge of programming language structures and logic.
• Knowledge of interpreted and compiled computer languages.
• Ability to apply programming language structures (e.g., source code review) and logic.