Cybersecurity Offensive Specialist / vulnerability

DESCRIPTION OF THE TASKS

The consultant’s main objective will be to assist in assessing the security posture of a large and complex IT infrastructure from a technical point of view. The assessment will be mostly based on the Critical Security Controls, with some additional specific requirements including internal policies and guidelines.

The consultant will perform the following tasks:

• Review existing documentation to understand the system, to assess the completeness of the information and to identify discrepancies between documentation and the system.
• Interact with IT infrastructure teams, development teams, security operations center (SOC), and compliance officers, to gather information on how the various system components are configured, how they interoperate, and how they are accessed and managed.
• Interact directly with some of the system’s components such as workstations, Windows and Linux servers, hypervisors, Kubernetes clusters, network devices, etc. to verify the configuration compliance and device hardening.
• Perform network scans, systems and application vulnerability scans, to verify compliance with the documentation, and identify vulnerabilities.
• Document information gathered through documentation review, and through interactions with the system and its engineers as supporting evidence to report on control implementations.
• Assess the compliance of system components with the related Critical Security Controls and sub-controls, qualitatively and quantitatively, or report if the control or sub-control isn’t pertinent/applicable in the system’s context.
• Prepare a comprehensive Cybersecurity assessment report, including a description of the issues identified for each security control, a reference to the supporting evidence, and proposed remediation actions.
• Identify and document missing processes, procedures or additional security controls to help further improve the system’s security posture.

SPECIFIC KNOWLEDGE, SKILLS AND EXPERTISE

The following specific knowledge, skills and expertise are required for the performance of the above listed tasks:

Very good knowledge in:

• network engineering (switch, router, DNS, Load Balancing, etc.)
• system engineering (Microsoft and Linux)
• security engineering (Firewall, VPN, encryption, proxies, etc.),
• virtualization platforms (ESX vSphere, Nutanix, VDI),
• Kubernetes

Knowledge in the following will be considered an asset:

• vulnerability scanning (including web apps and APIs)
• barebone server management (BMC/ILO)

Certification such as the following will be considered an asset:

• GIAC Critical Controls Certification (GCCC)
• GIAC Certified Enterprise Penetration Tester (GPEN)
• GIAC Web App Penetration Testing and Ethical Hacking (GWAPT)

Experience working in Classified environments will be considered an asset.