IT Security Analyst, Arista

• Expertise in manual penetration testing techniques and the use of advanced offensive security tools (Burp Suite, Cobalt Strike, Metasploit, etc.)
• Familiarity with security frameworks and approaches such as SAST, DAST, fuzzing, property-based testing, symbolic execution, and network simulation
• Demonstrated ability to identify and exploit vulnerabilities in API authentication and authorization mechanisms
• Expert knowledge of hacking authentication methods such as OAuth, SAML, and JWT
• Knowledge of macOS and Windows Active Directory systems and their security implications
• Deep understanding of Linux operating systems and their security implications
• Ability to analyze and understand complex software architectures and codebases
• Basic knowledge of Python or Go programming languages for scripting and tool development
• Have experience in threat modelling, red/blue teaming, working with best-in-class independent engineering teams
• BA or BSc. in Computer Science, Information Security, or a related field
• 6+ years of experience in penetration testing, with a strong focus on cloud security
• Expert-level knowledge of cloud platforms (AWS, Azure, GCP) and their security services
• Proven experience in API security testing and authentication hacking
• Strong understanding of Linux, macOS and Windows Active directory operating systems and software development practices
• Proficiency in using penetration testing tools and frameworks, including commercial tools like Checkmarx, Invicti, and Synopsys etc
• Excellent communication and collaboration skills
• Deep understanding of the MITRE ATT&CK framework
• Experience working in a software development environment

Desirable

• Conduct in-depth penetration testing of cloud environments (AWS, Azure, GCP), focusing on identifying complex vulnerabilities and security misconfigurations
• Perform penetration testing of containerized applications (Docker, Kubernetes) and serverless architectures
• Develop and execute custom penetration testing methodologies and tools to simulate real-world attacks
• Utilize commercial security tools such as Checkmarx, Invicti, and Synopsys for static and dynamic analysis
• Perform comprehensive security assessments of RESTful and other API architectures
• Perform security testing for distributed systems and microservices
• Work closely with software engineers to provide security guidance and recommendations
• Collaborate effectively with cross-functional teams, including software engineers, cloud architects, and security professionals
• Communicate security findings and recommendations clearly and concisely to both technical and non-technical audiences
• Stay up-to-date on the latest cloud security threats, vulnerabilities, and attack techniques
• Conduct security research and develop new penetration testing methodologies
• Administer and optimize Cloud Security Posture Management (CSPM) and SaaS Security Posture Management (SSPM) tools
• Configure and maintain cloud security tools and platforms to ensure continuous monitoring and threat detection
• Work with Infrastructure as Code tools such as Terraform and CloudFormation to ensure secure cloud deployments
• Configure, deploy, and maintain Web Application Firewalls (WAF) in production and development environments