Senior Cyber Security Engineer / CSET Lead

Description

• Overseeing CSET Team operators and providing guidance and subject matter expertise to government personnel
• Supporting offensive security/red team/adversarial emulation testing
• Executing Red Team engagements in a variety of networks using real-world adversarial Tactics, Techniques, and Procedures (TTPs) from conception to report delivery
• Developing comprehensive security testing strategies and programs across NCRC-U to provide assurance that security controls are designed and operating effectively
• Developing innovative accelerators, tools, mechanisms, and processes to enhance the security team's velocity and scale to customer needs
• Facilitating multiple stakeholders to agree on appropriate solutions and verifying that risks are mitigated appropriately
• Demonstrating creativity, insight, intellectual flexibility, and sound business judgment throughout the process
• Working independently but collaborate with cross-functional to provide security engineering consulting and control design recommendations to reduce risk
• Conducting open-source intelligence gathering, network vulnerability scanning, exploitation of vulnerable services, lateral movement, install persistence in a target network(s), and manage C2 infrastructure
• Systematically analyzing each component of an application with the intent of locating programming flaws that could be leveraged to compromise the software through source code review or reverse engineering
• Developing payloads, scripts and tools that weaponize new proof-of-concepts for exploitation, evasion, and lateral movement
• Safely utilize attacker tools, tactics, and procedures when in sensitive environments/devices
• Evading EDR devices such as Windows Defender and Carbon Black to avoid detection by Defenders/behavioral based alerting in order to further the engagement objectives
• Demonstrating expertise in one of the following: Active Directory, Software Development, Incident Response, or Cloud Infrastructure
• Carefully document and log all exploitation activities
• Continually exercise situational awareness in order quickly identify any instances of cohabitation
• Documenting identified vulnerabilities and researching corrective/remediation actions in order to recommend a risk mitigation technique(s)
• Demonstrating new vulnerabilities and assist Network Defenders (Blue Team) with the refinement of detection capabilities
• Maintaining knowledge of applicable Red Team policies, Standing Ground Rules, regulations, and compliance documents
• Communicating effectively with team members and during an engagement
• Ability to think unconventionally in order to develop adversarial TTPs
• Keeping current with TTPs and the latest offensive security techniques

[#LI-DG1]

Requirements

• Bachelor’s degree with a focus in computer science, computer information systems, engineering, mathematics, management information systems, cybersecurity, cyber operations, or a related discipline with corresponding experience and demonstrated mastery of relevant computer science topics
• 5+ years of cyber adversarial emulation experience, to include penetration testing of modern Windows and Linux operating systems, IP-based networks and protocols, 802.11 networks, and/or web applications, hardware hacking, software defined networks/RF
• 10+ years of experience in leading complex and technically diverse teams of cyber professionals (software developers, system administrators, penetration testers, incident responders, etc.)
• Intermediate knowledge of known Advanced Persistent Threat (APT) actor Techniques, Tactics, and Procedures (TTPs), to include familiarity with terminology from Mitre ATT&CK® used to describe TTPs used in cyber attacks
• Intermediate knowledge of techniques and tools used for exploit development of common operating systems, software debugging, and application fuzzing
• Intermediate knowledge of tools and techniques used for incident response, reverse engineering, and digital forensics
• Superior oral communication skills, including the ability to project confidence and enthusiasm, in the following core areas: formal presentations; soliciting goals and requirements from range users; explaining adversarial emulation in the context of testing and training events; effectively communicating event and environment requirements to CSET members; explaining cost estimates based on estimated levels of CSET effort; managing expectations as relevant to CSET TTPs; and explaining technical nuances and significant attributes of advanced cyber attacks to non-cyber-savvy audiences
• Superior technical writing skills, including the ability to author, review, and provide input and feedback to documents drafted by CSET personnel, as well a