[Hiring] Application Security Consultant @Converge Technology Solutions

Role Description

The Application Security Consultant delivers on a variety of red team projects and techniques with a focus on business outcomes and helping our clients reduce risk through technical testing. Professional services tasks will include working with diverse Fortune 1000 clients to fully test their environments.

• Business focused technical testing – apply advanced technical methods to test, prove and validate technical controls within client applications.
• Conduct technical assessments of client web applications, APIs, mobile applications, and AI enabled applications.
• Perform threat analysis, including identifying critical organization assets and services, relevant threat actors, and likely threat events.
• Perform pre-assessment research and preparation including reconnaissance, documentation and customer interviews.
• Document security weaknesses, including steps to reproduce.
• Analyze security findings, including risk analysis and root cause analysis.
• Research and propose practical remediation.

Qualifications

• Ethical and Critical Thinking.
• Apply industry standards and best practices including the OWASP Application Security Verification Standard (ASVS), various OWASP Top 10’s, Open-Source Security Testing Methodology Manual (OSSTMM), and the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Framework.
• Involvement in security-related projects / communities including CTFs.
• Analytic sharpness in thinking like a threat actor or attacker.
• Be authentic, trustworthy, straightforward, and honest.
• Have a client-first mindset and the ability to interact professionally with customers.
• Possess a blue-collar work ethic with the willingness to wear many proverbial ‘hats’ and have a flexible outlook towards your work.
• Be competitive and have a performance-based drive to succeed, including self-sufficiency and the ability to work as part of a team.

Requirements

• Ability to conduct network-layer penetration tests of external and internal client networks.
• Knowledge of common Active Directory attacks, adversary-in-the-middle attacks, and relay based attacks common in Windows-based networks.
• Experience with password-spraying and password cracking.
• Obfuscation/Encoding designed to bypass or defeat various controls or countermeasures.
• Experience bypassing common security technologies such as advanced EDR solutions.
• Conducting social engineering exercises with adherence to a defined Rules of Engagement document.
• Experience conducting wireless penetration tests against modern wireless networks.

Education and Experience

• Bachelor’s degree in Computer Science, Computer Information Systems, or equivalent preferred.
• OSWE certification or equivalent advanced level certs are required.
• Other Offensive Security certifications are a plus.
• Network testing skills are a plus.
• Excellent report writing and consultative skills.
• Experienced penetration tester and vulnerability assessor.

Physical Requirements

• Prolonged periods of sitting at a desk and working on a computer.
• Must be able to lift up to 15 pounds at times.