Penetration Testing Engineer II

• Perform basic penetration and security testing using preconfigured tools and scripts.
• Assist with reviewing and analyzing security control issues and identified vulnerabilities.
• Apply security severity ratings with guidance.
• Document security findings in workflow reporting tools and build knowledge of security testing tools.
• Assist in designing solutions so security processes and applications work in tandem for product/system components and modules.
• Evaluate design tradeoffs based on business requirements and support conversion of high-level designs into detailed module/component designs.
• Adhere to security and compliance frameworks when creating designs.
• Maintain updated logs and documentation of daily network performance.
• Monitor performance data to ensure adherence to defined SLOs for simple network applications and systems.
• Understand alerts generated by monitoring tools.
• Assist in analyzing existing solutions against business or technical requirements.
• Prepare and maintain requirement traceability matrices across business requirements, functional requirements, design, and test cases.
• Contribute to user stories for components/modules and simple requirements.
• Assist design teams in outlining parts of larger network infrastructure components and systems.
• Provide expert advice and guidance on information and best practices.
• Build stakeholder relationships, identify business needs, implement processes, monitor results, and pursue improvements.
• Support company policies, mission, values, ethics, compliance, inclusion, collaboration, customer/member focus, and continuous improvement.

• Option 1:
  Bachelor's degree in computer science, information technology, engineering, information systems, cybersecurity, or related area.
• Option 2: 3 years’ experience in penetration testing or related area at a technology, retail, or data-driven company.
• Knowledge of security principles, frameworks, methodologies, controls, risk frameworks, security testing techniques, secure coding frameworks and standards, scripting, operating systems, networking, mobile technology, cloud computing services, and IoT/embedded systems.
• Knowledge of software architecture, distributed systems, scalability, design patterns, disaster recovery, tech stacks, nonfunctional requirements, security standards/frameworks/methodologies, SSP, SRCR, cloud platforms, IoT, and new software/hardware platform technologies.
• Knowledge of network monitoring and alerting tools, monitoring metrics and KPIs, SLIs, and SLOs.
• Knowledge of traceability matrices, risk analysis methodologies, cost analysis, business objectives, classification of requirements, and user stories.
• Knowledge of architectural blueprint design, industry standards and best practices, network infrastructure topologies, platforms, and protocols.
• Preferred:
  Certification in Security+, Network+, GISF, or GSEC.
• Preferred:
  Knowledge of WCAG 2.2 AA standards, assistive technologies, and digital accessibility best practices.

Demonstrates expertise in penetration testing, security frameworks, and compliance standards while effectively collaborating with design teams to ensure security processes align with business requirements. Proficient in documenting security findings and maintaining requirement traceability across various project components.

• Penetration Testing
• Security Frameworks
• Network Monitoring Tools
• Requirement Traceability Matrices
• Security+ Certification

• Security Testing Techniques
• Scripting
• Operating Systems
• Networking
• Cloud Computing Services
  
  IoT/Embedded Systems
• Software Architecture
• Risk Analysis Methodologies
• Design Patterns
• Disaster Recovery

• Stakeholder Relationship Building
• Collaboration
• Continuous Improvement

• Security+
• Network+
• GISF
• GSEC

• Security Principles
• Compliance Frameworks
• Digital Accessibility Best Practices
• WCAG 2.2 AA Standards
• Network Infrastructure Topologies

• Workflow Reporting Tools
• Monitoring Metrics
• KPI
• SLI
• SLO