Technical Security Testing

About the job Technical Security Testing

**Purpose of the job**

Evaluate the security controls for Orange EGs Internal and External systems and Identify new vulnerabilities and exploits that can jeopardize the Integrity, Confidentiality and availability of our Information Systems.

**Duties and responsibilities**
- Perform initial penetration testing for newly acquired/developed systems.
- Identify security issues and vulnerabilities that can jeopardize the confidentiality/Integrity/Availability of information systems.
- Develop scripts, tools and methodologies to enhance red teaming processes
- Programming skills supporting tool development and customization (shell scripting, Perl, Python, Ruby, C, C++, C#, Java)
- Recognize and safely utilize attackers tools, tactics and procedures.
- Provide technical advise to system/business owners and/or developers on how to mitigate the identified issues.
- Propose compensating controls to mitigate/reduce risks where resolving the root cause is not possible.
- Provide advise to system administrators on how to harden their systems.
- Perform telecom specific security testing to insure the security of our access, core and packet core networks. Identify and resolve any discovered issues.
- Perform periodic penetration testing against Orange EG's critical systems to address any new security issues.
- Run periodic vulnerability scans against Orange EG's systems, and insure the findings are addressed in a timely manner according to the asset's criticality and the risk
- Run on demand scans for newly announced vulnerabilities and address those vulnerabilities with their owner
- Provide executive and detailed technical reports on findings to be used as an input in the risk management process
- Mastery of Unix/Linux/Mac/ Windows operating systems including bash and powershell
- Perform assessments against internal and external security standards including but not limited to PCI-DSS, SOX, ISO-27001, and Orange Global Security Policy
- Map business objectives and strategies to identify testing objectives and establish a business oriented risk level.
- Determine needed tools and budget to enhance security testing process.
- Supervise and guide Pentesting team activities
- Ability to define and scope penetration testing requirements
- Ability to document and communicate vulnerabilities and associated security risks with the stakeholders

**Job specification**

**Education**
- University degree in Telecommunication, Information Technology or Computer Science.
- Fluently reading and writing in English language..
- Certifications such as GPEN, GCIH, OSCP, OSCE, GWAPT, GAWN and/or GMOB is a must

**Experience**
- 4-7 years experience in at least three of the following:

- Network Penetration testing
- Social Engineering assessment
- Shell scripting and automation of simple tasks using perl, python, ruby and/or powershell
- Developing, extending or modifying exploits, shellcodes, or exploit tools

**Source code review for control flow and security flaws**
- Familiarity with the Telecom industry and its security posture

**Skills and abilities**
- Executive Presence, Highly effective communicator, well established influencing and negotiating skills
- Strong analytical skills; able to quickly digest any issue encountered and recommend an appropriate solution
- Strong client service orientation
- Self motivated without the need for significant management oversight
- Dynamic team player
- Ability to deal with ambiguity and make expert judgement in the situations where no precedent exists
- Excellent verbal and written communication skills including the ability to author and present materials ranging from detailed technical specifications tp high level presentations
- Strong understanding of the roles impact on the entire company.
- Ability to maintain a steady work pace with high level of accuracy.
- Must possess a strong sense of ethics and integrity with respect to identified critical security findings (Revenue/Image Impacting)