Cybersecurity Engineer Senior - Híbrido en Nissan Motor Corporation

Summary:
The Cyber Security Engineer is responsible for conducting in-depth research, documenting threats, understanding the risk to the business, and sharing information with those who need to know. Among the research conducted, the analyst will seek to uncover patterns and trends and be forward-thinking as to how threats may evolve. Furthermore, the analyst will participate in simulation exercises designed to uncover weaknesses related to threats, with the goal of implementing defensive solutions prior to attacks and disrupting attacks in progress. The analyst will also distill threat intelligence so technical and non-technical contacts can understand it and make educated decisions about next-step actions. The Cyber Security Engineer works in tandem with Manager and Sr. Manager to elevate the company’s security posture.

Job Duties:
- Manage vulnerabilities across applications, endpoints, databases, networking devices, and mobile, cloud and third-party assets.
- Conduct continuous discovery and vulnerability assessment of enterprise-wide assets. 
- Document, prioritize and formally report asset and vulnerability state, along with remediation recommendations and validation.
- Communicate vulnerability results in a manner understood by technical and non-technical business units based on risk tolerance and threat to the business, and gain support through influential messaging.
- Procure and maintain tools and scripts used in asset discovery and vulnerability status.
- Leverage vulnerability database sources to understand each weakness, its probability and remediation options, including vendor-supplied fixes and workarounds.
- Formally report testing initiatives, along with remediation recommendations and validation.
- Conduct tactical assessments that require expertise in social engineering, application security (web and mobile), physical methods, lateral movement, threat analysis, internal and external network architecture and a wide array of commercial and bring-your-own (BYO) products.
- Develop and maintain tools and scripts used in penetration-testing and red team processes.
- Support purple team exercises designed to build strength across disparate teams.
- Work closely with the security operations center (SOC) to leverage intelligence sources, identify new threats in the wild and verify the organization’s security posture against them.
- Work closely with infrastructure teams to advise and support remediation efforts to close vulnerability exposure to new threats in the wild and verify the organization’s security posture against them.
- Regularly research and learn new TTPs in public and closed forums, and work with colleagues to assess risk and implement/validate controls as necessary.
- Maintain an active database comprising third-party assets, their vulnerability state, remediation recommendations, overall security posture and potential threat to the business.   

Skills and Experience:
- 5 to 7 years of experience overall
- Advanced english level
- Bachelor degree in IT field or related
- Nice to have one or more of security certifications including GCED, OSCP, OSCE, GCIH GPEN, GWAPT, or CISSP.
- Nice to have experience working with one or more of the following security frameworks such as Gramm-Leach Bliley Act (GLBA), Payment Card Industry (PCI), Health Information Portability and Accountability Ace (HIPAA), Sarbanes-Oxley Act (SOX) and the General Data Protection Regulation (GDPR).
- Proficient in scripting languages such as Python, PowerShell, Bash and Ruby.
- Competent with testing frameworks and tools such as Burp Suite, Cobalt Strike, Kali Linux, Nessus, and PowerShell Empire.
- Strong operating system knowledge across *nix, Windows and Mac; proficient with networking protocols.
- Proficient with vulnerability management solutions such as Qualys, Nessus, Kenna Security, Tanium and open source.
- Preferably some experience with vulnerability management across Amazon Web Services (AWS), Microsoft Azure or Google Cloud Platform (GCP).
- Familiarity with defensive and monitoring technologies such intrusion prevention/detection systems (IPS/IDS), security information and event management systems (SIEMs), firewalls, endpoint protection (EPP) and endpoint detection/response (EDR) tools, as well as user and entity behavior analytics (UEBA).
- Understanding of OWASP, the MITRE ATT&CK framework and the software development lifecycle (SDLC).

Note:
We are looking profiles specialized either in:
- Offensive
- Defensive
- SOC/Monitoring