Senior Information Security Analyst/Penetration Tester

About This Role

Monitor firm security systems, perform penetration tests, and identify and mitigate suspicious events. This role also supports Security Operations activities and assists in the deployment and operation of information security systems.

Responsibilities

• Perform real-time security log and event analysis to contain and mitigate information security threats from SIEM, DLP, IDS, IPS, antivirus, firewalls, and system security logs.
• Conduct manual and automated penetration testing of web applications, APIs, networks, cloud environments, and mobile apps.
• Simulate real-world cyber-intrusion techniques to identify security vulnerabilities and validate practical exposures/risks.
• Develop automation workflows, routines, and scripts to support advanced testing efforts and remediation validation.
• Contribute to red team engagements, threat modeling, and purple team exercises.
• Assist in maintaining existing security systems like IPS/IDS, Anti-Virus, EPO, SIEM, and NAC.
• Assist with security technologies deployment, configuration, troubleshooting, maintenance, patching/upgrading, and decommission.
• Make enhancements to existing monitoring and security operations and contribute to a Continuous Monitoring program framework.

Requirements

• 7+ years of experience in information security
• Strong knowledge of network services, vulnerabilities, exploits, attack vectors, and TTPs
• Proven experience in penetration testing, ethical hacking, or purple teaming
• Strong knowledge of OWASP Top 10, MITRE ATT&CK, CVSS, and common exploit techniques
• Proficiency with tools like Burp Suite, Metasploit, Nmap, Nessus, Kali, Bloodhound, or similar
• Familiarity with scripting (e.g., Python, PowerShell) for automation and vulnerability validation
• Understanding of IT infrastructure, networking, system internals (Windows/Linux), and web/application security
• Strong knowledge of server and desktop operating systems, routers, switches, firewalls, and other network equipment
• Experience with cloud environments (SaaS, iDP, AWS, Azure, GCP) and cloud security testing

Qualifications

• Bachelor’s degree in related field or discipline
• Minimum of 7 years of experience in information security

Nice to Have

• SPLUNK Administrator or Power User
• Knowledge of mobile app security vulnerabilities (iOS, Android) and threat modeling
• Participation in Capture The Flag (CTF) events or offensive security challenges

Skills

* Required skills

Certifications