Associate Red Team Engineer

What You'll Do

• An Associate Red Team Security Engineer at Veeva is expected to be strong in offensive security domains, testing, techniques, and practices. Engineers in this role work closely with application product teams throughout Veeva. Security engineers will provide technical leadership and advice to developers, engineers, and third-party consultants
• As an Associate Red Team Engineer, you must show exemplary judgment in making informed technical trade-offs of testing, short-term fixes, long-term security gains, and product team development. Above all else, a strong sense of customer advocacy is necessary to focus on the ultimate goal of keeping Veeva and its customers secure
• Penetration tests of new products, features, and technologies
• Test web applications, mobile applications, and desktop applications
• Conduct full cycle engagements with development teams independently, or as part of a team
• Assist with automation efforts on the team
• Thoroughly document exploits, attack chain, proof of concept scenarios for technical reviews
• Communicate findings and discoveries to prioritize and execute remediation plans
• Coordinate findings and remediation from third party penetration testers
• Maintain related testing systems for our internal and third-party testing programs
• Conduct red team and purple team exercises
• Review Veeva product release notes and select new features to test throughout the year

Requirements

• BS in Computer Science or related field, or equivalent work experience
• Experience in an Information Security role, preferably in web application penetration testing, offensive security, reverse engineering, or application security
• Experience with various testing tools, such as Burp Suite, Netsparker, Kali Linux, Metasploit, Nmap, Nessus, etc.
• Knowledge and understanding in various disciplines such as security engineering, system and network security, authentication and security protocols, cryptography, and application security
• Knowledge of detection and remediation of the OWASP Top 10 and SANS Top 25
• Software development experience using Python, Java/Kotlin, Swift, C#, and PHP
• Experience with cloud service providers, preferably AWS and its various technologies and APIs
• Experience with AWS Linux, AWS Linux 2, Windows Server 2012, 2016 and 2019, and Ubuntu

Nice to Have

• Industry penetration certifications such as OSCP, GPEN, GXPN, GWAPT etc.
• Experience with Web Application Firewalls (WAF), IDS/IPS or other security platforms
• Mobile testing on iOS and Android applications as well as OSX and Windows applications
• Experience in conducting phishing exercises
• Experience in CTF competitions, CVE research and/or Bug Bounty recognition
• Experience in reverse engineering and the decompiling of Java
• Experience in Advanced Persistent Threat exploits
• Knowledge of fuzzing, memory corruption, and exploit development
• Industry security certifications such as CISSP, CEH or others

Perks & Benefits

• Medical, dental, vision, and basic life insurance
• Flexible PTO and company paid holidays
• Retirement programs
• 1% charitable giving program

Compensation

• Base pay: $50,000 - $85,000
• The salary range listed here has been provided to comply with local regulations and represents a potential base salary range for this role. Please note that actual salaries may vary within the range above or below, depending on experience and location. We look at compensation for each individual and base our offer on your unique qualifications, experience, and expected contributions. This position may also be eligible for other types of compensation in addition to base salary, such as variable bonus and/or stock bonus.