Security Assurance Advisor

Lead, Direct, Strategize, Govern and Conduct Penetration testing projects across Tonomous and its subsidiaries. Lead, Direct, Strategize, Govern and Conduct Red-Team operational projects across Tonomous and its subsidiaries. Lead, Direct, Implement, Govern, and operate Bug-Bounty Practice across Tonomous and its subsidiaries. Lead and Report on SecDevOps effectiveness and integration through effective Assurance practices. Lead projects that Simulate highest skilled real-world attackers /hackers to conduct attacks across all possible Tonomous channels and its subsidiaries. Lead, Design and execute advanced scenarios that Test, and bypass Tonomous Security Controls & evade all defense and security solutions. Defend and Protect Tonomous against State sponsored threat actors by participating in confidential and Critical Incidents that can have Financial, Regulatory, Reputational, Availability and Customer Impact. Lead and develop advanced custom malwares, backdoors, program stubs and modules that evade the defense mechanisms and solutions. Lead and design a practice within Security Assurance that focuses on researching about new vulnerabilities, TTPS, Threat actors, leading security blogs and suggest enhancements based upon applicability. Design and participate in purple team operations that Directs security teams to improve the effectiveness of vulnerability detection, threat hunting and network monitoring. Lead, Design and Execute projects that focus on People security, by conducting advanced social engineering attacks. Lead and effectively manage external consultants with regards to red teaming & Crowd sourced Pen testing with a wide range of technical expertise. Lead and Manage Team of ethical Hackers. Plan effective business context and critical driven coverage of outsourced security assurance program Evaluate the outcomes of the security assurance program for quality, coverage and depth and integrate with GRC factory to translate into Business contextualized Risks, in collaboration with the CS Risk Function. Minimum 8+ years of experience of hands in Red Teaming, Penetration testing, defense evasion, malware development for red team operations in a large IT enterprise. Knowledge of Active directory exploitation. Knowledge of defense evasion. In-depth understanding of Penetration Testing methodologies across all stacks (network/infra, mobile, web, IT domain, telco). Knowledge of windows and Unix operating systems. Knowledge of security solutions such as (AV, EDR, Firewalls, Proxy, ATP solutions, DLP solutions, Database monitoring solutions, Deception technologies etc.) and evasion of the same. Coding and scripting skills across multiple languages (PowerShell (must), c, c+ (must), java, python (must), ruby, Perl, PHP etc. Knowledge of web and other backdoors including web development stack. Ability to write custom tools for C&C which will evade conventional security solutions. Ability to read and debug code (Source code analysis). Understanding of common tools and technologies used within a security monitoring center (SIEM, Orchestrator, Behavior analytics etc.). Understanding of modern age technologies such of machine learning, data science, big data. Understanding of CI-CD pipeline and automating the same. Demonstrable Leadership and Strategic skills. Experience working with innovation, co-creation, and partner collaboration. Minimum of two years of progressively complex experience in a business or corporate environment. Experience working with the Middle Eastern culture is a plus. 7+ years of professional experience in the cyber security field. Must be fluent in English Published CVE's, Rewarded Bug Bounties with top notch companies. Published Scientific Journals /Research Papers with top notch publications (SCI Indexed). Open-source security Tools published on GitHub, Bit bucket etc. Bachelor's degree in computer science, Computer Engineering, or related topic. Master's degree in computer science, Computer Engineering, or related topic or equivalent Minimum three of the following is required: (OSCP, OSWE, OSED, OSEP, CRTE, CRTP, GWAPT, GPEN etc.)