Penetration Test Engineer

Hybrid role if located less than 50 miles away from the Miramar, FL office. 

Fully remote if located more than 50 miles away from the office.

A penetration-tester/red team member is a very hands-on representative of the information security team. This role is highly technical, and candidates must possess a solid understanding of information security, preferably with a strong computer science background. Pen-testers/red teamers must understand applications, networking and various operating systems, along with tools and frameworks, and they must maintain a high level of rigor to stay up to date with advancements in technology while also retaining knowledge of older systems and applications that may still be in use in the enterprise.

Penetration-testers/red teamers must constantly search for system and application weaknesses to exploit, but they are also expected to always maintain a level of professionalism. The position must collaborate with others on the team for remediation and additional validation, as well as contribute to other collaborative approaches driven by the security team strategy, such as purple teaming, to enhance skillsets for both red and blue team members.

While some automated tools will be leveraged, the penetration-tester/red teamer must realize this is not solely a point-and-click role but requires hands-on expertise with a variety of tools to simulate attacker tactics, techniques and procedures (TTPs). When performing red team exercises, the penetration-tester/red teamer must strive to avoid detection. In addition to stealthy engagements, however, penetration-testers/red teamers must also participate in visible and announced assessments for new and existing services, infrastructure and applications to help the team identify weaknesses before an attacker does.

1. Perform Penetration Testing activities using approved tools at their disposal.
2. Document all testing activities, including written description, screenshots, tools, scripts used and level of risk to internal and external customers.
3. Conduct tactical assessments that require expertise in social engineering, application security (web and mobile), physical methods, lateral movement, threat analysis, internal and external network architecture and a wide array of commercial and bring-your-own (BYO) products.
4. Develop and deliver detailed executive and technical reports to internal and external customers.
5. Maintain extensive knowledge of complex computer networks and systems.
6. Maintain extensive knowledge of cybersecurity strategies, terms, attack vectors and mitigation techniques.
7. Program custom scripts using approved programming languages to improve the effectiveness of penetration activities.
8. Work with internal and external customers to define a scope of work for all activities.
9. Define and document Penetration Test methods related to all aspects of testing, documenting and reporting activities.
10. Perform simulation activities on a bi-annual basis on all internal systems.
11. Prepare potential impact analysis of any scope of work delivered internally or externally.
12. Maintain all Penetration Testing tools used to conduct testing.
13. Develop and maintain a testing lab for ongoing training and attack testing.
14. Evaluate and recommend new solutions to improve testing, tracking and reporting capabilities.
15. Participate as a member of a team daily.
16. When necessary, assist in threat and incident response (IR) tabletop exercises as well as postmortem drills with a focus on measurable improvements and benchmarking to show progress (or deficiencies requiring additional attention).

Other duties as assigned.

Bachelor’s degree from college or technical school preferred; and 3 to 5 years Penetration Testing experience. 3 -5 years of infrastructure security implementation, management, monitoring, and audit activities. Certified in some or all the following:

• Certified Ethical Hacker (CEH) Practical certification preferred.
• CREST Registered Penetration Tester (CRT)
• GIAC Certified Penetration Tester (GPEN)
• Offensive Security Certified Professional (OSCP)
• Technology specific certifications are a plus, (Cisco CCNA, Microsoft MCP etc.)

Computer Skills: To perform this job successfully, an individual must demonstrate Penetration Testing skills with detailed examples of actual tests conducted. Provide examples of documentation including but not limited to note taking, final report delivery. Proficient in scripting languages such as Python, PowerShell, Bash and Ruby.

Competent with testing frameworks and tools such as Burp Suite, Metasploit, Cobalt Strike, Kali Linux, Nessus, PowerShell Empire and AutoSploit.

Ability to obtain and maintain persistence within corporate systems, while avoiding detection.

Familiarity with defensive and monitoring technologies such intrusion prevention/detection systems (IPS/IDS), security information and event management systems (SIEMs), firewalls, endpoint protection (EPP) and endpoint detection/response (EDR) tools, as well as user and entity behavior analytics (UEBA).

Understanding of OWASP, the MITRE ATT&CK framework and the software development lifecycle (SDLC).

What We’ll Offer You

• Pay Range: $100,000 - $140,000 / year base, OTE based on several factors including but not limited to education and work experience.;
• Professional development
• A culture that celebrates success and diversity
• Medical, Dental, Vision
• 16 Holidays, 15 days PTO, 7 sick days
• 401k with a match and tuition reimbursement

The base salary range for this position at the time of this posting is indicated above. Individual compensation varies based on job-related factors, including location, business needs, level of responsibility, experience, and qualifications.

Claro Enterprise Solutions, Inc.  is an Equal Employment Opportunity (EEO) employer.