Job Description: Senior Offensive Security Engineer – Security Operations

Oracle internal Job Code/Name:

Discretionary Posting Title:  Senior Offensive Security Engineer

 

Why Oracle NetSuite?

One word—transformation.

At Oracle NetSuite, we believe the cloud is here to stay and so do our 20,000+ customers. We believe businesses should not be bogged down by the overhead of bulky data centers and expensive personnel to run it all. Businesses need to be lean, efficient and agile. NetSuite is literally transforming business around the globe by providing a cloud-based, unified system that delivers unprecedented capabilities to drive business forward. Founded in 1998 as THE cloud ERP pioneer, Oracle NetSuite’s global business unit has transformed the business operations of our customers without the high costs and inefficiency of on-premise systems.

 

Transform your career at Oracle NetSuite

At Oracle NetSuite, we work hard and we work smart. We hire fierce competitors. We hire individuals that are fearless trail blazers. Oracle NetSuite employees take the hill, we prefer action over inaction, we are tireless in our mission and we pause only to celebrate our success.  And we DO celebrate, because if you don’t have fun along the way, then what’s the point? 

 

Summary

As a senior member of the Offensive Security team the candidate will have daily responsibilities in providing leadership and mentoring to a team of Offensive Security Engineers focused on the security of a comprehensive set of modern, innovative microservices and infrastructure.  The candidate will also participate in “hands-on” Penetration Testing and Red Teaming responsibilities. 

 

Responsibilities

• Performs penetration testing and attack simulations on business-critical infrastructure including internal servers, networks and applications to identify and resolve security flaws.
• Experiments with various methods attackers could use to exploit information security vulnerabilities.
• Uses standard methodologies and techniques for conducting penetration testing, including developing standard toolsets and automating testing.
• Completes security testing activities
• Completes threat assessment reports that outline penetration test findings and presents findings to management.
• Verifies potential targets for exploit

Qualifications

• Minimum 5 years combined experience from at least three of the following: security testing, systems development, systems administration, network administration, scripting, and security testing automation required.
   

Preferred but not required qualifications include:

• BS or MS in Computer Science, Computer Security or Computer Engineering.
• Holds relevant industry certifications such as OSCP/ CREST CRT, CREST CCT Inf/App, OSCE, CISSP, GSEC, GPEN, GCFW, GWAPT, GAWN or equivalent.

 

Responsible for the planning, design and build of security architectures; oversees the implementation of network and computer security and ensures compliance with corporate security policies and procedures.

Responsible for basic planning, design and build of security systems, applications, environments and architectures; oversees the implementation of security systems, applications, environments and architectures and ensures compliance with information security standards and corporate security policies and procedures. Assist in development of incident response capabilities, training, and tool validation. May research, evaluate, track, and manage information security threats and vulnerabilities in situations where analysis of well-understood information is required and where computer programming/scripting knowledge is required. May participate in an incident management team, responding to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may assist the Incident Commander during serious incidents. Participates in developing new methods, and playbooks, as well as basic scripts, applications, and tools. Research industry trends and constantly assess current controls and threat posture of new and existing products and services. Recommend and implement new security controls across Oracle’s line of business (LOB). Improve current processes and workflows to minimize manual efforts.

Minimum of 5 years related experience in an information security role, supporting security programs and security engineering/architecture in complex enterprise environments. Hands on experience with enterprise security architecture, engineering and implementation required. Knowledge of compliance program security controls, like ISO 27001, SOC 2, HITRUST, and FedRAMP, as applied to cloud SaaS, PaaS and IaaS operations. Familiarity with SDLC principles and scripting & programming languages (such as Terraform, Python, Ruby, etc.). Preferred but not required qualifications include: Bachelor-level university degree in a relevant field from an accredited university, or equivalent. Experience in developing secure, scalable cloud architectures and distributed systems. Experience with high-level software design and development and the design, use, and deployment of automation and orchestration frameworks. Demonstrable scripting or programming experience.