Job Description: Principal Offensive Security Engineer – Security Operations

Oracle internal Job Code/Name:

Discretionary Posting Title:  Principal Offensive Security Engineer

 

Why Oracle NetSuite?

One word—transformation.

At Oracle NetSuite, we believe the cloud is here to stay and so do our 40,000+ customers. We believe businesses should not be bogged down by the overhead of bulky data centers and expensive personnel to run it all. Businesses need to be lean, efficient and agile. NetSuite is literally transforming business around the globe by providing a cloud-based, unified system that delivers unprecedented capabilities to drive business forward. Founded in 1998 as THE cloud ERP pioneer, Oracle NetSuite’s global business unit has transformed the business operations of our customers without the high costs and inefficiency of on-premise systems.

 

Transform your career at Oracle NetSuite

At Oracle NetSuite, we work hard and we work smart. We hire fierce competitors. We hire individuals that are fearless trail blazers. Oracle NetSuite employees take the hill, we prefer action over inaction, we are tireless in our mission and we pause only to celebrate our success.  And we DO celebrate, because if you don’t have fun along the way, then what’s the point? 

 

Summary

As a senior member of the Offensive Security team the candidate will have daily responsibilities in providing leadership and mentoring to a team of Offensive Security Engineers focused on the security of a comprehensive set of modern, innovative microservices and infrastructure.  The candidate will also participate in “hands-on” Penetration Testing and Red Teaming responsibilities. 

 

Responsibilities

• Document, design and implement Red Team exercises and infrastructure

 

• Performs penetration testing and attack simulations for business critical infrastructure including internal servers, networks and applications to identify and resolve security flaws.  May also lead and supervise others competing these tasks.
   
• Researches and experiments with various methods attackers could use to exploit information security vulnerabilities.
   
• Develops standard methodologies and techniques for conducting penetration testing, red teaming, including developing standard tool-sets and automating testing.
   
• Oversees and directs security testing activities within specific Oracle Lines of Businesses.
   
• Completes threat assessment reports that outline red team/penetration test findings and presents findings to management.
   
• Verifies and automates exploits by developing scripts for colleagues to utilize.

 

Qualifications

• Minimum 8 years combined experience from at least three of the following: security testing, systems development, systems administration, network administration, scripting, and security testing automation required.
• Experience with Red Team exercises /infrastructure
   

Preferred but not required qualifications include:

• BS or MS in Computer Science, Computer Security or Computer Engineering.
• Holds relevant industry certifications such as OSCP/ CREST CRT, CREST CCT Inf/App, OSCE, CISSP, GSEC, GPEN, GCFW, GWAPT, GAWN or equivalent.
• Has Common Vulnerabilities and Exposures (CVEs).
• Has contributed to an open source project.
• Experience with security tools such as Cobalt Strike, PoshC2,

• Experience with automation tools such as Terraform and ansible

 

Develops and executes programs and processes to reduce information security risk and strengthen Oracle’s security posture.

Supports the strengthening of Oracle’s security posture, focusing on one or more of the following: risk management; regulatory compliance; threat and vulnerability management; incident management and response; security policy development and enforcement; privacy; information security education, training and awareness (ISETA); digital forensics and similar focus areas. Risk Management: Brings advanced level skills to assess the information security risk associated with existing and proposed business operational programs, systems, applications, practices and procedures in very complex, business-critical environments. May conduct and document very complex information security risk assessments. May assist in the creation and implementation of security solutions and programs. Regulatory Compliance: Brings advanced level skills to manage programs to establish, document and track compliance to industry and government standards and regulations, e.g. ISO-27001, PCI-DSS, HIPAA, FedRAMP, GDPR, etc. Researches and interprets current and pending governmental laws and regulations, industry standards and customer and vendor contracts to communicate compliance requirements to the business. Participates in industry forums monitoring developments in regulatory compliance. Threat and Vulnerability Management: Brings advanced level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required. Incident Management and response: Brings advanced level skills to respond to security events, identifying possible intrusions and responding in line with Oracle incident response playbooks. May operate as Incident Commander on serious incidents. Digital Forensics: Brings advanced level skills to conduct data collection, preservation and forensic analysis of digital media independently, where an advanced understanding of forensic techniques is required. Other areas of focus may include duties providing advanced level skills and knowledge to manage Information Security Education, Training and Awareness programs. In a Corporate Security role, may manage the creation, review and approval of corporate information security policies. Mentors and trains other team members. Compiles information and reports for management.

Minimum of 8 years experience in information systems, business operations, or related fields, at least 5 years of which must be from at least one of the following: Information security risk management; information security program management; Industry/Government security compliance program management (ISO-27001, GDPR, HIPAA, FedRamp, etc.); threat and vulnerability management; incident management and response; security policy development and enforcement; privacy, information security education, training and awareness (ISETA), information security solutions development, etc. required. Strong knowledge of: Cloud architecture and security principles. Risk Management Frameworks. *nix and Windows system administration. Experience with: Logging and log analysis. Identity management principles and technology. Preferred but not required qualifications include: Bachelor-level university degree in a relevant field from an accredited university, or equivalent. CISSP, CISM, CISA, CIPP or other equivalent certification. Comprehensive knowledge of security design for networks, databases, infrastructure, and cloud computing. Experience writing security incident and vulnerability reports for leadership and other stakeholders. Ability to effectively communicate and influence secure product and network design in a collaborative environment. Comprehensive knowledge of digital forensics. Strong knowledge of web technologies, middleware, database, OS, firewalls, network communication protocols and methods. Knowledge of encryption technologies and architectures. Expert level experience in evaluating and assessing security threats across a variety of environments and industries. Expert level understanding of secure networking principles, routers, switches and load balancers.

As part of Oracle's employment process candidates will be required to successfully complete a pre-employment screening process. This will involve identity and employment verification, professional references, education verification and professional qualifications and memberships (if applicable).