Hybrid Red Team Operator – Assistant Vice President

at MUFG

• Job title: Red Team Operator – Assistant Vice President
• Job type: Full Time
• Experience level: Lead
• Salary: $110,000 - $135,000 per year
• Degree requirement: Bachelor's Degree
• Tech skills: Distributed Systems, Linux, SQL
• Location requirements: Hybrid, Jersey City, United States

About the role

• Red Team Operator enhancing cybersecurity for Mitsubishi UFJ Financial Group. Leading tactical assessments and mentoring junior team members in advanced security measures.

Responsibilities

• Developing guidelines for the usage, control, maintenance and audit-readiness of information and computer resources that are used in the distributed processing environment.
• Analyzing and addressing customer security requirements for all business applications existing on a distributed platform.
• Assisting in the evaluation, selection, and installation of security software products for distributed platforms.
• Identifying distributed systems security issues as they arise and coordinating with the security architect to ensure that issues are addressed and resolved in a timely basis.
• Conduct tactical assessments that require expertise in social engineering, application security (web and mobile), physical methods, lateral movement, threat analysis, internal and external network architecture and a wide array of products
• Document and formally report testing initiatives, along with remediation recommendations and validation
• Maintain tools and scripts used in penetration-testing and red team processes
• Conduct research into real-world threat actor tactics, techniques, and procedures (TTPs) and apply that knowledge to Red Team Exercises
• Assess new technologies, software applications, and devices for potential avenues of exploitation
• Develop exploits based on identified vulnerabilities
• Develop scripts, tools, or methodologies to enhance Red Team processes
• Work with teammates to consistently learn and share advanced skills and foster team excellence

Requirements

• Bachelor's Degree in Computer Science or related fields; applicable specialized training; or equivalent work experience - equally preferable
• Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), OSCP, OSCE, GWAPT, or other security certifications desired
• Understanding of one or more compliance frameworks: NIST, FFIEC, GLBA, SOX, PCI, etc.
• 5-7 year of experience conducting penetration-testing/red team engagements
• Experience in planning and executing advanced attacks that evade network and endpoint security controls to demonstrate the potential adverse impact caused by a threat actor
• Experience with implementing red team assessment methods, tools, and techniques
• Experience identifying and exploiting common web-application vulnerabilities, such as: SQL Injection, DOM Manipulation, Authorization System Bypass, Design Logic issues, bounds checking, role & access validation, and filter evasion.
• Experience handcrafting/dissecting HTTP conversations
• Experience in developing, extending, or modifying exploits and offensive security tools (shellcode, implants, reflective loaders, etc.), as well as operational experience exploitation, lateral movement, and persistence on Windows and Linux systems, bypassing preventative and detective endpoint and network security controls, C2 frameworks (Cobalt Strike and Metasploit), using common offensive security tools (nmap, CrackMapExec, Impacket, Responder, etc.)

Benefits

• comprehensive health and wellness benefits
• retirement plans
• educational assistance and training programs
• income replacement for qualified employees with disabilities
• paid maternity and parental bonding leave
• paid vacation, sick days, and holidays