Work as part of a team performing Red and Purple Team Campaigns for IOActive clients, both remotely and on-site
Perform adversarial emulation, assumed breach scenarios, post-exploitation, social engineering, and physical security testing
Manage project tasks and deadlines on a multi-time-zone team
Develop unique tools to assist in project goals
Exploit vulnerabilities found in client’s people, processes, and technology; then clearly communicate complex vulnerabilities to both technical and non-technical client staff
Create comprehensive technical reports explaining technical and business risk of the vulnerabilities found
Participate in project conference calls with clients and on business development calls in support of sales activities
Create and lead technical customer presentations
Provide technical leadership/mentorship to the consulting team and to our clients on security topics
Contribute to the security industry through presentations, whitepapers and/or research
Requirements
Experience performing and leading covert red team operations
Penetration testing experience in Network, Web applications, Wireless networks, Physical security, and Social engineering
Experience with C2 and post-exploitation frameworks, including Cobalt Strike, Empire, Metasploit, Throwback, and similar tools
Understanding and proficiency with some of the following: Python, Ruby, PowerShell, Java, and Shell scripting
Knowledge and experience with enterprise network/system/application architecture and design including complex environments utilizing Microsoft Windows, Active Directory, and Linux
Deep understanding on Windows and Linux systems administration and post-exploitation activities on each platform
Ability to present complex material in a digestible, consumable manner to all levels of management
Highly experienced with OS, services, and application hardening
Strong ability to find vulnerabilities and develop proof of concepts
Ability and desire to travel at least 50% of the time – both nationally and globally