Responsibilities:

• Conduct assessments identify risks within an organizations cyber security governance compliance programs  

• Measure and report clients’ compliance with established industry or National/International government requirements such as PCI DSS, CMMC, FEDRAMP, GDPR, CCPA, etc. 

• Perform analysis and testing to verify the strengths and weaknesses of mobile and web applications and web services (SOAP, WSDL, UDDI)  

• Perform Internet penetration testing using blackbox and whitebox methodologies  

• Review application code, system configurations and device configurations using manual and automated techniques  

• Communicate technical findings to a non-technical audience effectively  

• Create and review threat intelligence programs for clients using established intelligence models  

• Work with a variety of cyber security and privacy frameworks such as ISO, NIST, CIS.  

• Support the development and implementation of tools such as eGRC, used to help manage security programs across a variety of organizations  

• Develop target operating models for cyber security programs including budgets, resource levels, reporting structure, etc.  

Required Qualifications:

• Bachelor's degree or equivalent experience

• Strong knowledge of computer network technologies, protocols/topologies, digital forensics and endpoint protection, or threat intelligence  

• Software development, programming and/or scripting experience (Perl, Python, C, Java, PHP, ASP, etc.)  

• Ability to track threat actors across Dark Web criminal forums and marketplaces and ability to communicate findings  

• Ability to track malware campaigns and understand adversarial activity from an intelligence perspective  

• Basic understanding of intelligence, including intelligence lifecycle, Kill Chain, Diamond model, and Priority Intelligence Requirements  

• High degree of integrity and confidentiality, as well as ability to adhere to company policies and best practices  

• 0 – 2 years of relevant experience 

Preferred Qualifications:

• Practical hands-on or lab experience with IT infrastructure components such as servers, firewalls, IDS systems and other network infrastructure components  

• Practical hands-on or lab experience with security applications, such as a AppScan, Metasploit, BurbSuite, Nessus, Social Engineering Toolkit, Kali Linux, etc., or other commercial and public domain security tools  

• Operating system configuration and security experience (HP-UX, Linux, Solaris, AIX, etc.) Configuration and security experience with web servers and web applications (Apache HTTP/Tomcat, Microsoft IIS, Sun One, Oracle iPlanet, IBM WebSphere, etc.)  

• Database Configuration and Security experience (MySQL, Microsoft SQL, IBM DB2, Sybase, Oracle, etc.)  

• Familiar with security testing techniques such as network discovery, port and service identification, vulnerability scanning, network sniffing, fuzzing, penetration testing, configuration reviews, firewall rule reviews, social engineering, wireless penetration testing and password cracking Internship or overall experience with threat intelligence vendor or familiarity with various threat intelligence tools and platforms