Penetration Tester

JOB RESPONSIBILITIES:

In addition to performing internal application and product security assessments the Analyst II | Application and Product Security will be expected to support response to possible breaches of security based on newly disclosed information. Other key duties include:

• Conduct security evaluation and threat assessments of embedded systems, mobile applications, web applications

• Conduct research for the purposes of finding new vulnerabilities and enhancing existing capabilities

• Circumventing security protection methods and techniques

• Performing data bus monitoring (snooping) and data injection

• Conduct communications protocol analysis in the embedded products, and applications

• Conduct wireless communications channel snooping, and data injection

• Reverse engineering complex systems and protocols

• Create detailed technical reports and proof of concept code to document findings

• Perform System Breakdown of the project/product before testing, identify and evaluate all the testing requirements and plan out the detailed testing activities, resources etc.

• Proactive detailed interaction with respective engineering group on the testing needs, testing progress/status and provide detailed analysis report

• Have effective Gitlab issue management reviewing and, providing mentorship and direction on planned testing activities for junior resources in line with defined processes and procedures. Assist in leading testing activities in all the regions, provide head-to-head support to Assessment Pillar Manager and help to drive continuous improvement in testing processes and procedures.

• Thorough adherence and follow-up of VERTIV SECURE requirements and Vulnerability Management and Incident Response processes.

• Preference given to other practical skills such as functional analysis, memory image capture, static memory analysis, and data element extraction, etc.

JOB REQUIREMENTS:

• A bachelor's degree in information technology, Computer Science or related Engineering field is highly desirable.

• Additional advanced security qualifications such as CISSP (Certified Information Systems Security Professional) certification, Offensive Security Web Expert (OSWE) or equivalent preferred.

• Three or more years experience in information, application, and embedded product security and/or IT risk management with a focus on security, performance, and reliability

• Solid understanding of security protocols, cryptography, authentication, authorization, and security

• Good working knowledge of current IT risks and experience implementing security solutions

• Ability to interact with a broad cross-section of personnel to articulate and enforce security measures

• Excellent written and verbal communication skills as well as business acumen

• Strong leadership, vision, effective communication and goal-oriented

• Strong ability to establish partnerships and influence change and achieve results within dynamic environment

• Meaningful technical contributions into the development lifecycle of an application, product, or service

Preferred knowledge experience includes

• Understanding and development experience of embedded systems / software, and web-based applications

• Linux network device driver/data-path performance exposure

• Familiarity with compilers, debuggers, disassemblers, and other low-level development and analysis tools

• Exposure to binary analysis tools such as IDA Pro, WinDbg, BinWalk, Valgrind, PIN, Panda, and S2E

• Working knowledge of hacking tools and techniques such as memory corruption exploits, rootkits, protocol poisoning, browser-based attacks, DNS poisoning, MetaSploit, nmap, Nessus, etc.

• Experience with UNIX kernel internals and low-level Windows internals

• Comfort with reading and understanding of x86 and/or ARM assembly

• Experience with program analysis techniques such as taint analysis, program slicing, symbolic execution, constraint solving, and dynamic instrumentation

• An understanding of common cryptographic algorithms and protocols including their weaknesses and attacks against them

• Ability to extract software/firmware from provided hardware

• Meaningful experience utilizing git (Github or gitlab)

• Understanding of network protocols and experience developing packet-level programs

• Experience with common microcontroller programming tools and debugging interfaces

• Linux network device driver/data-path performance exposure

• Exposure to Layer 2, Layer 3 networking, QoS

• Network and/or application security knowledge (L2/L3 firewall, DPI, IDS, IPS)

• Knowledge of common malware/botnet exploits and how they are targeted to exploit embedded systems

• Operating system configuration of Windows, Linux, Android, and iOS

• Computer boot process including boot loaders

• Conducting security evaluation and threat assessments of embedded systems, mobile applications, web applications

• An understanding of common cryptographic algorithms and protocols including their weaknesses and attacks against them

• Familiarity with compilers, debuggers, disassemblers, and other low-level development and analysis tools

• Having hands on real-time embedded C/C++ development experience that includes recent lab activities integrating with and debugging on target hardware.

The successful candidate will embrace Vertiv's Core Principals & Behaviors to help execute our Strategic Priorities.

OUR CORE PRINCIPALS: Safety. Integrity. Respect. Teamwork. Diversity & Inclusion.

OUR STRATEGIC PRIORITIES

• Customer Focus
• Operational Excellence
• High-Performance Culture
• Innovation
• Financial Strength

OUR BEHAVIORS

• Think Big and Execute
• Act With Urgency
• Own It
• Drive Continuous Improvement
• Promote Transparent and Open Communication
• Learn and Seek Out Development
• Foster a Customer-First Mindset
• Lead by Example

#LI-DS5