Penetration Tester - Bengaluru/Bangalore
- Shell
- 5 - 8 years
- Bengaluru
- 10 months ago
- Email to a friend
- Report this job
Job Description
The purpose of the IRM Function is to ensure that Shell is addressing Information Risks in an effective and efficient manner, commensurate with Shell risk appetite, and being seen as an industry leader among peers and key suppliers of security services.The Information Risk posture of Shell includes a wide variety of potential business impacts, such as HSSE impacts, production loss, financial and maintenance operations loss, loss of Most Confidential bidding data.
The IRM Function defines requirements for the assessment of Information Risks, defines the selection of mandated IT Controls, and defines and executes assessments of the design and operational effectiveness of these controls. The function organises communication campaigns to impact the behaviour of business and IT staff where it relates to Information Risks.In addition to these preventative measures, the IRM Function includes a Cyber Resilience function to understand the cyber threat landscape and the vulnerabilities to cyberattacks in IT systems and services, to detect malicious behaviour and to respond to incidents.
What's the role
As part of the Information Risk Management function, the CyberDefence capability has specific focus on identifying cyber threats, discovery of IT vulnerabilities, monitoring for cyber intrusions and response to security incidentsAs part of the CyberDefence capability the Penetration testing team has the following main areas of focus:
- To create a prioritized overview of Cyber vulnerabilities and put this in a context of IT services and Business applications
- Support the Vulnerability Lead in planning penetration tests based on new IT developments and hypothetical threat scenarios and find appropriate budget and sponsors
- Scope the tests in more detail and find information on network address and accounts
- Execute the tests preventing Business disruption as much as possible
- Report on findings, fixing high risk vulnerabilities as soon as possible and registering other vulnerabilities for later risk priorization and remediation where required
- Operate periodic vulnerability scanning tools and services such as Nexpose, Veracode and others
- Support the Vulnerability Lead in consolidating the vulnerability scanning tools where possible
- Integrate reporting with other CyberDefence data in IRM workflow system (Collective) and data analytics solution (IRM investigation platform).
What we need from you
- 5-8 years of total IT experience with at least 3 years' experience in IT security and preferably experience in attack and penetration testing/ethical hacking or technical IT audits
- Has excellent analytical skills and appreciates a technical challenge
- Has a good technical understanding of and experience with IT networks, infrastructure and applications
- Maintains knowledge and experience of current practice within own area of expertise and is aware of current developments within own area of expertise
- Is able to think and act like a hacker using his creativity to bypass IT defenses
- Preferably has performed penetration testing on IT infrastructure, web applications and mobile platforms.
- Has a solid understanding of IT networks and operating systems such as Windows and Unix/Linux.
- Has experience with analysing network traffic using tools such as tcpdump, wireshark.
- Has experience using open source scanning tools such as nmap, nessus, metasploit and/or commercial tools such as Rapid7, Quallys.
- Has experience with scripting tools and programming languages such as Perl, Python, C, C++, VBS, Java and analytical and reporting tools such as Excel, Sharepoint and preferably Splunk.
- Has relevant certifications such as, CISSP, SANS and preferably GIAC Penetration Tester (GPEN), SEC 560: Network Penetration Testing and Ethical Hacking, SEC 542: Web App Penetration Testing and Ethical Hacking, or GWAPT: GIAC Web Application Penetration
- Certifications such as OSC, OSWP, OSCE, OSEE, or OSWE
Job Classification
Industry: Petrochemical / Plastics / RubberFunctional Area:
Role Category: IT Security
Role: IT Security
Employement Type: Full time
Education
Under Graduation: Any GraduatePost Graduation: Any Postgraduate
Doctorate: Any Doctorate
Contact Details:
Company: ShellLocation(s): Bengaluru
Keyskills: C++ C VBS Perl Python Unix network penetration testing web applications nessus it audit CyberDefence metasploit linux IT infrastructure ethical hacking Splunk nmap Sharepoint
Similar positions
Job Listings
We are in open beta version of website, please let us know if any issues, at: info(at)indigojobs.in
