Senior Security Consultant - Organization Security (Fully Remote, Worldwide)

<p><strong>About CENSUS</strong> </p> <p>CENSUS is an internationally accl<em>ai</em>med<em> Cybersecurity </em>services provider. We support the needs of multiple industries, providing IT and OT <em>security</em> services to public and private organizations around the world, ranging from financial institutions and critical infrastructure to automotive and secure communications, including Fortune 500 companies. Powered by cutting-edge research, scientific analysis and in-depth engineering experience across various industries &amp; technologies, CENSUS delivers unparalleled <em>security</em> consulting &amp; assessment services for products (software, services, devices, and large-scale platforms), infrastructure, and organizations. </p> <p><strong>About the Job / <em>Key</em> Responsibilities</strong> </p> <p>CENSUS’ bespoke<em> cybersecurity </em>services are built upon a <em>tal</em>ented pool of <em>Security</em> Engineers, whose role extends beyond mere adherence to industry best practices. Under the management and mentorship of our Senior and Principal technical managers, our <em>Security</em> Engineers are entrusted with assessing the completeness and maturity of an extensive range of<em> cybersecurity </em>products and features. Along with capturing defects and inefficiencies, in-depth mitigation strategies are explored, presented, and re-evaluated post their integration, in a highly agile and adaptive service delivery model. </p> <p>We are looking for <em>tal</em>ented &amp; ambitious professionals to grow our <strong><em>Security</em> Engineering </strong>team and join our ongoing mission to deliver in-depth and top-tier<em> cybersecurity </em>services to our valued clients. As part of this role, you will use your knowledge and experience - in the <strong><em>Penetration</em> Testing</strong> <strong>and</strong> <strong>Application <em>Security</em> dom<em>ai</em>ns</strong> – to execute <em>security</em> assessments and mitigation consulting activities scoped across organizations and products of various industries. As part of your d<em>ai</em>ly tasks, you will: </p> <ul><li>Conduct<em> penetration </em>tests (network, social, <em>physical</em>, adjacent, and more) that target Organizations, Networks, Application and <em>Cloud</em> infrastructure and evaluate their <em>security</em> defenses in-depth. </li><li>Assess the <em>security</em> posture of applications (mobile, web / <em>cloud</em>, core networks, etc.) via functional testing, fuzz testing and other applicable methodologies. </li><li>Review the <em>security</em> maturity of edge systems (<em>IoT</em>, kiosk terminals, operator terminals, etc.) that are interconnected via public or private networks. </li><li>Conduct targeted research for the purposes of understanding a vendor specific technology, identify its <em>security</em> critical components, and prioritize impactful attack vectors. </li><li>Document and present <em>security</em> risks &amp; mitigation recommendations in both technical- and business-oriented language. </li></ul> <p><strong>Minimum Qualifications</strong> </p> <ul><li>BSc or MSc. in Electrical Engineering, Computer Science, Computer Engineering, or equivalent practical experience. </li><li><strong>4+ years of experience</strong> in VAPT, IT <em>security</em> or application <em>security</em> (mobile, web front-end, backend, etc.) related roles. Experience can be an assessment / consultancy role, an equivalent role in other engineering organizations, or a combination of them. </li><li>Proven experience in vulnerability assessment,<em> penetration </em>testing or <em>security</em> testing at the network, application, or system level.</li><li>Active Directory and <em>Cloud</em> Infrastructure Knowledge </li></ul> <p><strong><em>Key</em> Skills</strong> </p> <ul><li>Experience with Information <em>Security</em> fundamen<em>tal</em>s (risk management, <em>security</em> best practices, data protection, communication <em>encryption</em>, authentication, authorization, etc.) and cyber threats of modern systems &amp; networks. </li><li>Experience with the technologies and <em>security</em> controls present in application (web full-stack, WAF, EDR, data <em>encryption</em>, transport protection, etc.), network (firewalls, segmentation, IDS/IPS, VPN, etc.) and Windows / Linux system (privileges, roles/groups, AV/Endpoints, secret storage, etc.) architectures. </li><li>Experience in identifying, exploiting, and reporting vulnerabilities in the context of Red Team / VAPT tasks (<em>OWASP</em> Web / Mobile Top10 vulnerabilities, access control, insecure configurations, secrets management, etc.). </li><li>Experience in Active Directory Attacks (Pass-the-Hash, Pass-the-Ticket, Kerberoasting, Golden Ticket, Silver Ticket, DCSync, Credential dumping, Abuse of ACLs, Lateral movement via SMB, etc)</li><li>Experience in using pentest and other <em>security</em> related tools for information gathering, vulnerability discovery, exploitati