Cyber Threat Management Senior Penetration Tester

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

Senior Penetration Tester

EY will support you with career-long training and coaching to develop your skills. As EY is a global leading service provider in this space, you will be working with the best of the best in a collaborative environment. So, whenever you join, however long you stay, the exceptional EY experience lasts a lifetime.

The opportunity

EY GDS Manila is looking for highly skilled and experienced professional to be part of its Cyber Security practice. The candidate will be part of our Threat Exposure Management - Application Security Testing team and provide a world class services for our key customers globally.

Your key responsibilities

• Conduct penetration testing on applications and infrastructure:
  Perform penetration tests on web, thin, mobile, and thick applications or APIs, and computer networks and systems. The candidate will define the applicable tests and use a framework or methodology such as the unified kill chain framework. The candidate will then choose the appropriate tools to try to break into security-protected applications and networks to probe and identify vulnerabilities and come up with the latest methods for ethical hacking by regularly evaluating new penetration testing tools and techniques.
• Conduct security audits:
  Use security testing methods to identify ways that attackers could exploit weaknesses in security systems. Conducting network and system security audits, which evaluate how well an organization’s system conforms to a set of established criteria.
• Write security assessment reports:
  Document findings after conducting thorough research and testing and write security reports. Present solutions with key stakeholders within EY and to the clients. Provide feedback and verification/revalidation tests after security fixes are applied.

Skills and attributes for success

• In-depth knowledge of OWASP Top 10 and CVEs, and the ability to effectively communicate methodologies and techniques with development teams and operations

• Penetration testers work with computer systems and web applications and are comfortable using the following software and programs:

• Security assessment tools (such as Burp Suite, SQLmap, nmap, etc.)

• Operating systems (such as Linux, Unix, Windows) and web platforms (CMS, Apache, MS IIS, etc.)

• Programming languages and frameworks (such as SQL, C ++, JavaScript, Ruby, and Python)

• DevOps solutions such as Chef, Puppet, Jenkins, and Ansible

• Network and Security Infrastructure:

• Knowledgeable in Firewall Appliance (such as Fortigate, Palo Alto, Cisco ASA,etc.)•    End-point Protection (such as Symantec, McAfee, Carbon Black, etc.)

• Knowledgeable in L2 and L3 Networking devices (Cisco, Juniper, etc.)

• Understanding of Networking concepts (TCP/IP model, OSI Layers, network protocols, routing protocols, TACACS, Radius, VPN (GRE/IPSEC tunnel), etc. 

• Understanding of Wireless protocols (WPA, WPA2, WLAN, etc.)

• VA/PT experience in Mainframe, Thick Client

To qualify for the role, you must have

• Bachelor's degree in BE / M Sc (Stats, Maths, Computer Science)

• Perform vulnerability management, penetration testing, social engineering and exploitations

• Execute red team scenarios to highlight gaps impacting organizations security postures.

• Document and report testing results including screenshots and findings

• Additional expectations for Senior level with equal or more than 3 years of experience:

• Provide technical leadership and advise junior team members on attack and penetration test engagements.

• Perform in-depth analysis of penetration testing results and finalize report that describes findings, exploitation procedures, risks and recommendations.

• Execute penetration testing projects using the established methodology, tools and rules of engagements.

• Develop automated solutions that mitigate risks throughout the organization