Security Analyst Job Specification Must be a South African Citizen (Preferably without dual citizenship) and based in South Africa Minimum 3 years of Penetration Testing/Red Teaming experience required Including conducting different types of assessments, such as network, mobile, web, thick, wireless, social engineering, physical, etc. Programming experience required The duties for this role are divided into three areas of responsibility, namely Penetration Testing, Red Teaming and Research and Development. Penetration Testing Duties: Work as part of a vulnerability assessment and / or penetration testing team, taking direction from line managers and executing directives in a thorough and timely fashion Conduct vulnerability assessments on a wide variety of technologies and implementations utilising both automated tools and manual techniques Conduct network penetration tests Conduct application penetration tests (mobile, web and thick client) Conduct cloud security assessments Conduct social engineering assessments Conduct physical security assessments Train others on the use of vulnerability assessment and penetration testing techniques and tools Effectively communicate successes and obstacles with fellow team members and line managers/management Interface with client contact(s) and staff in a constructive and professional manner Develop subject matter expertise in offensive security tools, techniques and procedures Utilise common vulnerability assessment and penetration testing tools Explain in detail the attack methodology and logic used in exploiting each finding Provide training to clients Prepare and present assessment report deliverables to clients Perform technical quality assurance on reports Red Teaming Duties: Duties include but are not limited to the following: Initial reconnaissance - open-source intelligence (OSINT) for collecting information on the targets Initial compromise - gaining a foothold into the target environment through targeting weaknesses in people, process and / or technology. Deploy command-and-control servers (C&C or C2) and custom payloads to establish communication / persistence in the target's network. Develop tools, techniques and procedures to evade detection by blue team (including the development of custom payloads) Escalate privileges and maintain persistence Exfiltrate and / or complete objectives Research and Development Duties Research new vulnerabilities with a focus on high-profile products Understand the terminology and tactics employed by threat actors Research new attack methods Lead with novel and trendsetting ideas with a focus on: Threat and vulnerability research Offensive security Defensive security Liaise with management to ensure that the research being done aligns with our client''s strategies and goals Share research insights by means of blogs, publications and presentations at security events Analyse and document the core problems of specific critical vulnerabilities Write vulnerability advisories for clients