Manager, Offensive and Application Security; Remote

Position: Manager, Offensive and Application Security (Remote)
*
* Employment Type:

*
* Full time

** Shift:*
* *
* Description:

*
* Manages and develops the Offensive and Application Security Team. This role develops and performs penetration testing or adversary simulation engagements. The leader will oversee a team that communicates findings and strategy to client stakeholders including technical staff, executive leadership, and legal counsel. Provides constructive suggestions for improving our security posture and controls, hone its defensive capabilities, and measure the effectiveness of its security operations.

Maintains an effective and efficient approach to information security that is both balanced and consistent with the mission, values, and operating goals of Trinity Health.

+ Performs security reviews of application designs, covering all types of applications (web application, web services, mobile applications, thick client applications, SaaS).

+ Identifies and clearly articulates (written and verbal) findings to senior management and clients.

+ Participates in security assessments of networks, systems and applications.

+ Coaches members of the Red Team, guiding them in offensive security tactics and strategies.

+ Leads the secure code review program to ensure adherence to security best practices and policies.

+ Promotes continuous testing exercises in collaboration with the Incident Response and Security Monitoring teams to validate the effectiveness of security measures.

+ Develops automation to enhance the efficiencies of the security program, streamlining processes and improving response times.

+ Manages the overall performance of the team in terms of effectiveness, efficiency, productivity, and quality. Assigns work, completes staff evaluations, conducts new hire interviews, and mentors staff.

+ Oversees scheduling of resources to execute and support the threat intel domain through Red Team operational procedures (communication and tracking). Coordinates activities that may impact other IT supported areas.

+ Develops and maintains detailed documentation relative to application penetration testing (APT) and dynamic application security testing

+ Conducts (DAST), static application security testing (SAST), and source composition analysis (SCA)

+ Directly manages, mentors and supports the Application Security function in conducting secure code reviews, vulnerability assessments, and ensuring compliance with security best practices.

+ Evaluates and reports on application security metrics and performance, aligning with Trinity Health's strategic objectives and operational goals.

+ Facilitates the departmental initiatives to achieve business and organizational goals, vision and objectives. Develops and manages team budget.

+ Supports planning, communicating, coordinating, and performing manual penetration testing and security assessments at application, system and enterprise level. Identifies and drives process improvement within Red Team program.

+ Partners with business groups/ clients to design processes & scope of penetration testing & security assessment methodologies. Partners with the delivery team to identify and drive delivery of opportunities to automate, improve efficiency, reduce the number of steps to perform the function while ensuring quality.

+ Acts as a liaison between business and technical employees to translate requirements/needs in both directions. Works closely with the incident and threat hunting teams, and various lines of business to mitigate risk.

+ pay grade 17 range $122,.1074  Actual compensation will fall within the range but may vary based on factors such as experience, qualifications, education, location, licensure, certification requirements, and comparisons to colleagues in similar roles.

** Minimum Qualifications*
* + Bachelor of Science in Information Technology - Cyber Security, or an equivalent combination of education and experience.

+ Five (5) to seven (7) years of progressive experience with comprehensive knowledge of hardware, software, application, and systems engineering in multiple IT disciplines (network, web applications, server hardware and software, vulnerabilities, and risk - assessment and management) with a focus in the following information security disciplines.

+ 5+ years of information security experience

+ 3+ years of penetration testing, red teaming, ethical hacking, application security, or similar management experience

+ Experience and demonstrated knowledge of adversarial tactics, techniques and procedures. Strong understanding of threat actors and the TTPs used by known threat actors.

+ Comprehensive knowledge of information security practices (technical, operational, and administrative) in Network penetration testing and manipulation of network infrastructure.

+ Experience in performing external and internal penetration tests using security testing tools, such as Burp Suite, Mimikatz, Metasploit, Nessus, HP Web Inspect, or other tools. Applying an understanding of the principles of information security engineering, architecture,…