Large consulting firm looking to fill a variety of security positions.  Slots open in most major cities, but prefer NY, Short Hills, Philly, Tyson's Corner, Atlanta, Chicago, Detroit, Houston, Seattle, and San Francisco/Silicon Valley.  The job postings will reflect experienced hires, but I am more than willing to talk to junior folks that have the skills to hit the ground running.


Security Tester
Responsibilities:
•   Perform analysis and testing to verify the strengths and weaknesses of a variety of operating systems, network devices, web applications, and security architectures
•   Perform penetration testing (blackbox/whitebox testing) and network architecture reviews (manual/automated)
•   Assist with the development of remediation services for identified findings
•   Identify and clearly articulate (written and verbal) findings to senior management and clients
•   Help identify improvement opportunities for assigned clients
•   Supervise and provide engagement management for IT staff working on assigned engagements
Qualifications:
•   Bachelor’s degree in computer science or related field from an accredited college/university
•   Technical background in networking/system administration, security testing or related fields
•   In-depth knowledge of TCP/IP
•   Two or more years of Perl, Python, or C experience
•   Operating System Configuration and Security experience (HP-UX, Linux, Solaris, AIX, etc.)
•   Configuration and Security experience with firewalls, switches, routers, VPNs
•   Database Configuration and Security experience (MySQL, Microsoft SQL, IBM DB2, Sybase, Oracle, etc.)
•   Experience with security and architecture testing and development frameworks, such as the Open Source Security Testing Methodology Manual (OSSTMM), Information Systems Security Assessment Framework (ISSAF), and NIST SP800-115
•   Familiar with security testing techniques such as network discovery, port and service identification, vulnerability scanning, network sniffing, penetration testing, configuration reviews, firewall rule reviews, social engineering, wireless penetration testing, fuzzing, and password cracking and can perform these techniques from a variety of adversarial perspectives (white-, grey-, black-box)
•   Experience with discovery, utilizing, and possibly writing exploits for such vulnerabilities as buffer and stack overflows
•   Familiar with the logistics of security testing such as acquiring authorization for testing, reporting, risk analysis of findings, data handling, and legal considerations
•   In-depth knowledge of the security and privacy provisions of a variety of regulations and standards such as PCI, NERC/CIP, SOX, HIPAA/HITECH, FFIEC, EU Privacy Laws, ISO, and COBIT
•   Commercial Application Security tools experience (Qualys, Retina, nCircle, Acunetix, etc.)
•   Open source and free tools experience (Nessus, Metasploit, nmap, airsnort,Wireshark, etc.)
•   One or more of the following testing certifications: Certified Ethical Hacker (CEH); GIAC Certified Penetration Tester (GPEN); Offensive Security Certified Professional (OSCP); or equivalent development or testing certification (ECSA, CEPT, CPTE, CPTS, etc)
•   In addition, one or more of the following governance certifications is preferred: Certified Information Systems Security Professionals® (CISSP®); Certified Information Systems Auditor® (CISA®); Certified Information Security Manager® (CISM®)
•   Track record with published content / research work in the information security field
•   Demonstrated ability to build, maintain, and improve security testing labs, tools, and mobile equipment
•   Strong leadership and communication skills, technical knowledge, and the ability to write at a "publication" quality level in order to communicate findings and recommendations to the client’s senior management team