Job description
1. Conduct penetration testing on Systems/Applications/Websites:
- Perform security assessment and testing on Systems/Applications/Websites.
- Report and provide solutions and POC for vulnerabilities after assessment, coordinate with relevant departments to patch vulnerabilities.
- Verify security vulnerabilities on Systems/Applications/Websites, provide evidence when successfully exploiting vulnerabilities.
- Perform backup, recovery, and upgrade to ensure data integrity of assessed Systems/Applications/Websites.
- Organize training sessions and guide specialist teams on attack techniques.
2. Participate in building, deploying assessment tools and researching in-depth security assessment methods for Nova Group's Systems/Applications/Websites and member companies:
- Participate in building and deploying tools to support the department in assessing and testing IT systems.
- Participate in researching open-source frameworks, writing exploit code based on published CVEs.
- Participate in researching new methods in software vulnerability exploitation. Search for vulnerabilities in open-source frameworks.
- Research in-depth security assessment methods based on published or unpublished CVEs.
- Coordinate with teams and personnel in charge to: Deploy related work and projects, Handle in-depth level incidents.
- Participate in deploying projects of the Security and Compliance Department.
3. Provide opinions to support the Security team in improving the defensive capabilities of Nova Group's systems and member companies:
- Provide alert analysis from systems and request relevant teams to fix security errors related to managed Systems/Applications/Websites.
- Use Red Team perspective to provide advice on possible penetration/attack capabilities and support Blue Team in improving system defensive capabilities.
- Support technical teams to reduce/minimize identified risks.
- Advise management on new technologies and security solutions for Systems/Applications/Websites for units upon request.
4. Develop procedures, regulations, and guidance documents for system assessment and testing and perform backup and upgrade of assessment Systems/Applications/Websites:
- Develop procedures, regulations, and guidance documents related to assessment and testing Systems/Applications/Websites.
- Periodically review and update procedures, regulations, and guidance documents.
- Guide and support work for team members.
Requirements
1. Qualifications
- Bachelor's degree in IT, Cybersecurity, Information Systems, or related fields suitable for job requirements.
- Priority given to those with CEH, MCRTA, OSCP, OSWE, SANS SEC560, SEC542, SEC642, SEC 575 certifications or self-trained on platforms (HackTheBox, Pentesterlabs, ...).
2. Knowledge
- Security assessment methods according to OWASP standards.
- Clear understanding of manual and automated penetration testing techniques, including knowledge of common penetration testing tools and their impact on systems.
- Programming knowledge (Bash Shell, Python, Hermes AI, ...).
- General IT knowledge including hardware, software, and information security fields.
- In-depth knowledge of security systems and information security.
- Knowledge of cloud computing architecture.
- Knowledge of project implementation. Priority given to those with experience deploying and managing large IT systems.
- Knowledge of information security standards such as ISO27001 and information security assessment.
2. Experience
- At least 2-3 years of experience in security assessment and testing.
- Understanding of IT system architecture, network security, endpoint, application, and other security technologies.
- Proficient in OWASP, CVE, MITRE ATT&CK concepts.
- Understanding of security methods, risk management, and cyber attack prevention.
- Proficient in programming languages for analysis such as SQL, Python.
- Experience in researching, developing, and using AI tools for automation is an advantage.
3. Skills
- Good assessment and security incident analysis skills, able to respond quickly to threats.
- Good communication skills, ability to work in teams and coordinate with other departments to resolve incidents.