Senior Director- Offensive Security (Penetration Testing)

CyberOne is hiring! We hire smart, talented and high-performing professionals to push our organization forward and provide superior service to our customers. We each take accountability for our work, strive to make each other better, and genuinely love what we do. If you value learning new things, being innovative, and working in a supportive, collaborative environment, CyberOne may be the place for you.
If you are ready to raise the bar for your career and be part of our exciting journey, we would like to hear from you!
Position Overview
The Director - Team Ares Practice will be responsible for driving an offensive security program to holistically test customer environments for vulnerabilities and demonstrate the impact and resolution to the business through exploitation. This person will lead a multi-person team of Penetration Testing and Vulnerability Management engineers and consultants. The individual stepping into this role will lead by forming strong partnerships internally and externally to guide organizations and team members by providing vision, strategy, and prioritization to securing customer environments.
The ideal candidate will be based in the Dallas area, but not an absolute, where they can collaborate directly with service delivery teams onsite in accordance with our hybrid work schedule.

Essential Functions

• Serve as subject matter expert related to penetration testing, secure development, and secure configuration.
• Evangelize penetration testing and vulnerability services to broaden security awareness through use of the team’s services.
• Assist in the project lifecycle from initiation to delivery of service.
• Drive actionable metrics and reporting for operations and leadership transparency.
• Provide prompt attention and visibility into risks, vulnerabilities, and issues serving as an escalation path for project effectiveness.
• Closely support and collaborate with other CyberOne Professional Service teams.
• Own and drive Team Ares penetration testing program strategy that can be divided into multiple areas.

Project Management and Delivery
• Participate in discovery and analysis of client needs.
• Organize and lead offensive security services for clients of CyberOne.
• Demonstrated ability to deliver projects using well-defined methodology across various security disciplines such as but not limited to:
• Penetration tests (external, wireless, and web application)
• Wireless assessments
• Social Engineering (phishing, vishing, physical)
• VoIP
• Develop technical solutions to help mitigate security vulnerabilities.
• Provide external training to clients of CyberOne.

Training and Product Development
• Develop training programs and material to externalize to CyberOne clients or security conferences.
• Assist in development of other offensive security services that can be offered to clients.

Cyber Security Research
• Research and study security vulnerabilities from a multitude of product.
• Research and develop practical tools to protect native systems, including both host and network side defense.
• Collaborate with the security community in improving both offensive and defensive security methods and tools.
• Research and stay knowledgeable on paper/blog write-ups to share information with the community.
• Publish white papers.

Mentoring
• Mentor junior team members on technical/function aspects of offensive security operations.
• Technical mentoring includes penetration testing methodologies, vulnerability discovery, and scripting languages.
• Understand project lifecycle and ability to transfer knowledge to junior resources.

Offensive Security Development
• Develop tools to aid Team ARES, and the community, in conducting offensive security services.
• Experience performing Security Assessment work (vulnerability, penetration tests, web application, wireless security and social engineering).
• Using creative approaches to identify vulnerabilities that are commonly missed in security assessments.
• Exploiting vulnerabilities and identify specific, meaningful risks to clients based on industry and business focus.
• Performing complex wireless attacks both against wireless clients and access points.
• Using social engineering techniques to obtain sensitive information, network access and physical access to client sites.
• Ability to identify, describe and report vulnerabilities and standard remediation activities, to include clear demonstration of risk to clients through post-exploitation activities required.
• Experience with commercial and open-source security tools required (e.g., Nessus, Nexpose, SAINT, Qualys, Burp, NMap, Kali, Metasploit, Meterpreter, Wireshark, Kismet, Aircrack-ng, etc.)