Offensive Security Analyst, Senior

• Three (3) + years of experience in penetration testing or similar offensive security role
• Three (3) + years of experience in an incident detection/response role
• Three (3) years of professional experience with security engineering practices (e.g., web application security, network security, authentication and authorization protocols, cryptography, automation, and other software security disciplines)
•  3+ years of experience with interpreted or compiled languages (e.g., Python, Ruby, C/C++, Java, .NET); ability to follow code logic in unfamiliar languages
•  OSCP required
• Typically has a 4-year academic degree and 5+ years of information security or equivalent practical work experience
• Completes on-going training on-the-job, through courses, self-study, certifications and/or advanced degrees to maintain and enhance technical and business capabilities
• Hold and maintain at least one advanced penetration testing certification (OSWE, OSEP, GXPN, etc.). Knowledge of various security domains (e.g., system and network security, authentication & security protocols, cryptography, application security, incident response). Experience in developing security tooling and automation. Experience with cloud services
• Preferred Qualifications:  Knowledge of/experience with mobile application penetration testing. Hold and maintain additional penetration testing certification (OSWE, OSEP, GXPN, etc.) Experience with supporting the software development lifecycle, in particular the introduction of security at various phases to support both development needs as well as security requirements. Participation in CTF competitions, CVE research, and/or Bug Bounty recognition

TOP 3 SKILLS NEEDED:

1. Penetration Testing: The candidate should have over three years of experience in penetration testing or a similar offensive security role.

2. Incident Detection/Response: The candidate should have over three years of experience in incident detection and response.

3. Security Engineering: The candidate should have professional experience with security engineering practices, including web application security, network security, authentication and authorization protocols, cryptography, and automation

MUST HAVES: 

• Clear Communcation & Organization Skills: Clear Communication skills, will need to document findings and recommend remediations effectively.
• Team Player: Be able to collaborate with various teams and act as a technical resource.
• Proactive Attitude: Self Starter that is collaborative

Licensure, Certifications, and Clearances:
At least one advanced penetration testing certification (OSWE, OSEP, GXPN, etc.) is required. Additional certifications are preferred.

• Act 34

UPMC is an Equal Opportunity Employer/Disability/Veteran