Senior Red Team Offensive Security Engineer (Remote, EST or CST)
Piper Companies is seeking a Red Team Offensive Security Engineer for an award-winning, publicly traded worldwide Information Technology Organization. The Red Team Offensive Security Engineer will focus on reverse engineering, penetration testing, and security assessments of all products within the tech stack.
Responsibilities for the Red Team Offensive Security Engineer:
Ā Objective Setting: Define the business context, scope, and objectives of the engagement, aligning the Red Team's success criteria with the organization's goals.
Ā Reconnaissance and Threat Modeling: Gather extensive information about the target, such as IP ranges, domain names, and employee details. Use frameworks like MITRE ATT&CK to model potential threats and assess associated risks.
Ā Initial Access: Exploit vulnerabilities to gain initial access through techniques such as social engineering, physical attacks, or exploiting external attack surfaces.
Ā Establish Persistence: Maintain access by setting up backdoors, creating new accounts, and utilizing Command and Control (C2) frameworks.
Ā Escalation/Lateral Movement: Escalate privileges and move laterally within the organization, using defense evasion techniques and exploiting further vulnerabilities.
Ā Data Exfiltration: Discover, collect, and exfiltrate target data according to the defined objectives.
Ā Reporting and Debrief: Present a comprehensive report of findings, including an executive summary, detailed findings, control successes and failures, and recommendations for improvement.
Ā The tech stack includes: On-Prem (Windows and Linux), Cloud (AWS), IAM (Okta), O365, Slack, and Python
Requirements for the Red Team Offensive Security Engineer:
Ā At least 3 years of experience as part of a red team performing some of the responsibilities listed above
Ā Experience writing custom exploits
Ā Prior experience simulating real-world attack scenarios and Penetration Testing Web Applications
Ā Prior Experience working in Unix (Linux), Windows, and or Cloud Environments
Ā Solid understanding of Python, Go, or a similar language; must be able to code live.
Ā Must have the legal right to work in the United States without the need for employment sponsorship
Compensation for the Red Team Offensive Security Engineer:
Ā Salary Range: $180,000 - $215,000
Ā Full Benefits: Medical, Dental, Vision, 20 days of PTO, Sick Leave as required by Law, and 11 Federal Holidays
Ā This opportunity is remote but we are only considering candidates in the Eastern Standard or Central Standard Time Zones
SQL Injection (SQLi), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Remote Code Execution (RCE), Server-Side Request Forgery (SSRF), Broken Authentication, Session Hijacking, Insecure Direct Object References (IDOR), Security Misconfiguration, Sensitive Data Exposure, Input Validation, Privilege Escalation, Web Application Firewall (WAF) Bypass, Zero-Day Exploits, Phishing and Social Engineering, Credential Stuffing, Brute Force Attacks, Man-in-the-Middle (MitM) Attacks, API Security, Content Security Policy (CSP), HTTP Header Security, Subdomain Takeover, Directory Traversal, File Inclusion Vulnerabilities (LFI/RFI), Web Shells eecurity, Threat Intelligence, Vulnerability Assessment, Incident Response
#LI-JQ1
#LI-REMOTE
This job opens for applications on 01/30/2024. Applications for this job will be accepted for at least 30 days from the posting date
Apply Now
Responsibilities for the Red Team Offensive Security Engineer:
Ā Objective Setting: Define the business context, scope, and objectives of the engagement, aligning the Red Team's success criteria with the organization's goals.
Ā Reconnaissance and Threat Modeling: Gather extensive information about the target, such as IP ranges, domain names, and employee details. Use frameworks like MITRE ATT&CK to model potential threats and assess associated risks.
Ā Initial Access: Exploit vulnerabilities to gain initial access through techniques such as social engineering, physical attacks, or exploiting external attack surfaces.
Ā Establish Persistence: Maintain access by setting up backdoors, creating new accounts, and utilizing Command and Control (C2) frameworks.
Ā Escalation/Lateral Movement: Escalate privileges and move laterally within the organization, using defense evasion techniques and exploiting further vulnerabilities.
Ā Data Exfiltration: Discover, collect, and exfiltrate target data according to the defined objectives.
Ā Reporting and Debrief: Present a comprehensive report of findings, including an executive summary, detailed findings, control successes and failures, and recommendations for improvement.
Ā The tech stack includes: On-Prem (Windows and Linux), Cloud (AWS), IAM (Okta), O365, Slack, and Python
Requirements for the Red Team Offensive Security Engineer:
Ā At least 3 years of experience as part of a red team performing some of the responsibilities listed above
Ā Experience writing custom exploits
Ā Prior experience simulating real-world attack scenarios and Penetration Testing Web Applications
Ā Prior Experience working in Unix (Linux), Windows, and or Cloud Environments
Ā Solid understanding of Python, Go, or a similar language; must be able to code live.
Ā Must have the legal right to work in the United States without the need for employment sponsorship
Compensation for the Red Team Offensive Security Engineer:
Ā Salary Range: $180,000 - $215,000
Ā Full Benefits: Medical, Dental, Vision, 20 days of PTO, Sick Leave as required by Law, and 11 Federal Holidays
Ā This opportunity is remote but we are only considering candidates in the Eastern Standard or Central Standard Time Zones
SQL Injection (SQLi), Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Remote Code Execution (RCE), Server-Side Request Forgery (SSRF), Broken Authentication, Session Hijacking, Insecure Direct Object References (IDOR), Security Misconfiguration, Sensitive Data Exposure, Input Validation, Privilege Escalation, Web Application Firewall (WAF) Bypass, Zero-Day Exploits, Phishing and Social Engineering, Credential Stuffing, Brute Force Attacks, Man-in-the-Middle (MitM) Attacks, API Security, Content Security Policy (CSP), HTTP Header Security, Subdomain Takeover, Directory Traversal, File Inclusion Vulnerabilities (LFI/RFI), Web Shells eecurity, Threat Intelligence, Vulnerability Assessment, Incident Response
#LI-JQ1
#LI-REMOTE
This job opens for applications on 01/30/2024. Applications for this job will be accepted for at least 30 days from the posting date
Apply Now