JOB SUMMARY

This role focuses on various security-related tasks around our day to day product operation such as the execution of threat-led penetration testing, handling of external security findings, execution of red / purple team exercises and penetration testing of external and internal infrastructures, architecture and configuration review, source code review, attack simulation exercises, and cloud infrastructure assessments. The results of these findings should be communicated to the appropriate stakeholders.

Your main responsibilities would be:

• Monitoring for incoming vulnerability reports, testing for viability, categorisation of the findings and making sure they are fixed or properly mitigated.
• Execution of threat-led penetration testing and red / purple team exercises by utilizing well-known and established frameworks such as MITRE ATT&CK and TIBER-EU.
• Set-up and maintain automated testing systems to continuously monitor Storyblok's security posture
• Assist with performing social engineering assessments (email phishing, vishing, physical access attacks) to simulate the theft of passwords, infiltrate systems, and download malware / ransomware to assess the security awareness.
• Perform penetration tests on Storyblok assets, such as external and internal infrastructures and web applications to identify security weaknesses and misconfigurations.
• Perform security configuration assessments for cloud, network, servers and endpoints.
• Prepare reports and present on vulnerabilities and exploitation techniques.
• Coaching and developing team members through sharing of experience and knowledge.
• Keep up to date with the latest penetration testing techniques and the current threat landscape.
• Maintain knowledge about current security standards, systems, and authentication protocols.
• Provide awareness about potential threats and cyber security best practices.

EDUCATION AND EXPERIENCE

• Experience with large scale applications on Amazon AWS
• Experience with Linux, networking protocols, general utilities, and shell scripts
• Fluency in scripting languages like Bash, Ruby, or Python
• Experience with Cloud-native solutions
• Excellent knowledge of offensive security frameworks
• Experience with industry recognized security testing standards, penetration testing methodology and attack simulation tools.
• Working experience preferred related to the execution of red / purple team exercises and / or penetration testing of web and mobile applications, internal and external infrastructure, execution of social engineering assessments.
• Be able to conduct research and development and solve technical problems independently.
• Be a team player with good communication and interpersonal skills.
• Excellent communication skills