[Hiring] Penetration Testing Analyst @Sophos

Role Description

Sophos is seeking an experienced and motivated Penetration Testing Analyst 3 to join our Red Team. The Sophos Red Team is engaged by organizations worldwide to identify and exploit vulnerabilities within client environments, applying information security threat intelligence to uncover the same weaknesses real-world adversaries would target.

As a Penetration Testing Analyst 3, you will act as the point of contact for testing readiness, coordinating tasks, timelines, and communication between business, client, and project teams. You will be responsible for:

• Escalating issues to management and taking ownership of new challenges to add value.
• Focusing on either application security (web application penetration testing, mobile, API testing) or network security (vulnerability assessments, external penetration tests, internal penetration tests).
• Using both off-the-shelf and internally developed tools to execute manual testing for advanced attacks.

In this role, you will be responsible for:

• Test readiness activities to ensure engagements are ready to begin.
• Troubleshooting client readiness problems.
• Communicating with clients and tracking readiness status.
• Producing professional security assessment reports detailing vulnerability and exploit information for clients.
• Leading client-facing calls throughout each engagement.

The ideal candidate will bring strong technical communication skills, sound analytical and problem-solving abilities, and a proactive approach to researching new threats, vulnerabilities, and exploits.

You will excel as both a self-directed individual contributor and as a member of a larger team, performing other essential duties as assigned.

Qualifications

• 3+ years of experience in Information Security.
• Excellent client-facing and internal communication skills, both written and verbal.
• Demonstrate ability to learn quickly and thrive in a high-energy team environment.
• Professional, “get it done" attitude, work ethic, and strong team player.
• Solid organizational skills including attention to detail and multitasking skills.
• Minimum of 3 years of experience with penetration testing.
• Minimum of 3 years of experience with at least one of the following: Nmap, Metasploit, Kali Linux, Burp Suite.

Requirements

• Experience with NMap Scanning.
• Understanding of web application authentication methods.
• Experience with Linux.
• Understanding of networking and appliances (routers, load balancers, firewalls, WAF, IDS/IPS, web content filter/proxy).
• Understanding of tools to validate network access with a penetration testing platform.
• Offensive certifications such as CEH, WAPT, GPEN, GWAPT, GAWN, OSCP, etc.
• Knowledge of operating systems administration and internals (Microsoft Windows / Linux).
• Understanding of TCP/IP networking at a technical level.
• Experience with various application attack vectors, security test processes, and strong knowledge of common vulnerabilities (i.e. OWASP Top 10).
• Good troubleshooting skills, technical communication skills, both written and verbal; good analytical and problem-solving skills.

Benefits

• Sophos operates a remote-first working model, making remote work the primary option for most employees.
• Employee-led diversity and inclusion networks that build community and provide education and advocacy.
• Annual charity and fundraising initiatives and volunteer days for employees to support local communities.
• Global employee sustainability initiatives to reduce our environmental footprint.
• Global fitness and trivia competitions to keep our bodies and minds sharp.
• Global wellbeing days for employees to relax and recharge.
• Monthly wellbeing webinars and training to support employee health and wellbeing.