助理渗透测试员
Associate Penetration Tester
Netrio 是北美领先的MSP，专注于为中小型企业提供IT解决方案。我们通过管理IT、网络安全、云服务、连接性、语音和定制应用开发等服务，为跨行业的1000多家客户提供支持。
职位简介
我们为多个行业的客户提供主动安全评估服务。这个初级职位专注于内部和外部网络渗透测试。你将从一开始就与高级测试人员一起参与实际客户项目。
职责
- 执行外部网络渗透测试：攻击面枚举、服务和应用发现、凭证攻击，以及在授权范围内对暴露的服务进行利用
- • 执行内部网络渗透测试：网络和主机枚举、Active Directory侦察和攻击路径分析、凭证获取和重用、权限提升和横向移动
- • 验证漏洞扫描器的输出，并通过手动测试消除误报
- • 为每个发现的结果捕获可重复的证据
- • 进行修复后重新测试
- • 在每个项目中严格遵守授权范围和操作规则
任职要求
• 1-3年IT、系统或网络管理、SOC或相关领域的工作经验，或通过实验室和个人项目展示出的实际主动安全技能
• 扎实的网络基础：TCP/IP、DNS、SMB、LDAP、HTTP/S
• 熟悉Windows和Active Directory，包括常见的错误配置
• 能够在Linux终端中操作
• 熟悉标准工具，如Nmap、Nessus、Metasploit、Impacket、BloodHound、Responder、Hashcat和Burp Suite
• 基本的Python、PowerShell或Bash脚本编写能力
• 良好的书面沟通能力和专业的客户对接素养
优先条件
• 持有或正在攻读OSCP、PNPT、CPTS、eJPT或CRTP认证
• 有可详细讨论的实验室或CTF工作记录
• 有系统或网络管理经验
• 有云计算或Web应用测试的经验
最初发布于 Himalayas
查看英文原文
Netrio is a leading MSP in North America, specializing in IT solutions for small- to mid-market enterprises. We serve over 1,000 clients across industries with services including managed IT, cybersecurity, cloud, connectivity, voice, and custom application development.
About the Role
We deliver offensive security assessments to clients across a range of industries. This entry-level role focuses on internal and external network penetration testing. You’ll work alongside senior testers on live client engagements from the start.
Responsibilities
- Conduct external network penetration tests: attack surface enumeration, service and application discovery, credential attacks, and exploitation of exposed services within an approved scope
- • Conduct internal network penetration tests: network and host enumeration, Active Directory reconnaissance and attack path analysis, credential harvesting and reuse, privilege escalation, and lateral movement
- • Validate vulnerability scanner output and eliminate false positives through manual testing
- • Capture reproducible evidence for every finding
- • Perform remediation retesting
- • Operate strictly within the authorized scope and rules of engagement on every engagement
Required Qualifications
• 1-3 years in IT, systems or network administration, SOC, or a related field, or demonstrable hands-on offensive security skill through labs and personal projects
• Solid networking fundamentals: TCP/IP, DNS, SMB, LDAP, HTTP/S
• Working knowledge of Windows and Active Directory, including common misconfigurations
• Comfortable in a Linux terminal
• Familiarity with standard tooling such as Nmap, Nessus, Metasploit, Impacket, BloodHound, Responder, Hashcat, and Burp Suite
• Basic scripting in Python, PowerShell, or Bash
• Strong written communication and a professional client-facing demeanor
Preferred Qualifications
• OSCP, PNPT, CPTS, eJPT, or CRTP — held or in progress
• Documented lab or CTF work you can discuss in detail
• Prior systems or network administration experience
• Exposure to cloud or web application testing
Originally posted on Himalayas