网络安全专员
Cybersecurity Specialist
职位概述：
· 网络安全专家将负责实施、维护和审计组织的信息安全框架，重点在于符合ISO/IEC 27001标准。该角色确保公司数据和系统免受威胁，并在规定的法律和监管指南范围内运作。
主要职责：
• 实施并维护ISO/IEC 27001信息安全管理系统（ISMS）。
• 进行风险评估并制定针对网络威胁和漏洞的缓解策略。
• 确保信息安全政策、流程和控制措施持续改进。
• 执行内部审计并为外部ISO 27001审计和认证做准备。
• 管理和解决网络安全事件，协调响应计划和调查。
• 提供安全开发实践和安全系统架构方面的指导。
• 对员工和部门进行信息安全意识和最佳实践培训。
• 与IT、法律和合规团队合作，确保安全措施贯穿整个运营流程。
• 监控安全工具、日志数据和系统警报，以检测和响应异常情况。
渗透测试
• 对内部和客户系统进行应用程序、API、移动设备、网络和云渗透测试。
• 模拟真实世界攻击场景以发现可利用的漏洞。
• 开发自定义脚本、有效载荷或工具以支持高级测试需求。
• 用清晰的证明概念（PoCs）和技术影响分析记录发现结果。
漏洞评估与管理
• 使用行业标准工具（如Nessus、Qualys、OpenVAS、Burp Suite）进行持续漏洞扫描。
• 分析扫描结果，验证发现，并根据风险等级优先处理修复工作。
• 跟踪修复进度并向开发和DevOps团队提供指导。
• 维护持续的漏洞管理生命周期，包括发现、分析、报告和验证。
安全审查与咨询
• 与软件开发和DevOps团队合作进行安全代码审查和架构评估。
• 提供安全设计、配置和编码实践的建议。
• 通过清晰易懂的语言向客户提供漏洞、相关风险和缓解策略的解释。
监控与威胁情报
• 监控新兴威胁、漏洞利用和安全最佳实践
查看英文原文
Position Summary:
· The Cybersecurity Expert will be responsible for implementing, maintaining, and auditing the organization’s information security framework, with a strong focus on ISO/IEC 27001 compliance. This role ensures that the company’s data and systems are secure from threats, and operates within the required legal and regulatory guidelines.
Key Responsibilities:
• Implement and maintain the ISO/IEC 27001 Information Security Management System (ISMS).
• Conduct risk assessments and develop mitigation strategies for cyber threats and vulnerabilities.
• Ensure continuous improvement of information security policies, procedures, and controls.
• Perform internal audits and prepare the organization for external ISO 27001 audits and certifications.
• Manage and resolve cybersecurity incidents, coordinating response plans and investigations.
• Provide guidance on secure development practices and secure system architecture.
• Train employees and departments on information security awareness and best practices.
• Collaborate with IT, legal, and compliance teams to ensure security is embedded across operations.
• Monitor security tools, log data, and system alerts to detect and respond to anomalies.
Penetration Testing
• Conduct application, API, mobile, network, and cloud penetration tests on internal and client systems.
• Simulate real-world attack scenarios to uncover exploitable vulnerabilities.
• Develop custom scripts, payloads, or tools to support advanced testing needs.
• Document findings with clear proof-of-concepts (PoCs) and technical impact analysis.
Vulnerability Assessment & Management
• Perform ongoing vulnerability scanning using industry-standard tools (e.g., Nessus, Qualys, OpenVAS, Burp Suite).
• Analyze scan results, validate findings, and prioritize remediation based on risk levels.
• Track remediation progress and provide guidance to development and DevOps teams.
• Maintain a continuous vulnerability management lifecycle including discovery, analysis, reporting, and verification.
Security Review & Advisory
• Collaborate with software development and DevOps teams to conduct secure code reviews and architecture assessments.
• Provide recommendations for secure design, configuration, and coding practices.
• Support clients by explaining vulnerabilities, associated risks, and mitigation strategies in clear, understandable language.
Monitoring & Threat Intelligence
• Monitor emerging threats, exploits, and security best practices to keep assessment methodologies up to date.
• Integrate threat intelligence into testing strategies to mimic current attacker techniques (TTPs).
Documentation & Reporting
• Prepare detailed penetration test reports, executive summaries, and risk-based recommendations.
• Maintain accurate records of assessments, testing plans, methodologies, and remediation efforts.
• Present findings to both technical and non-technical stakeholders, internal and external.
Requirements:
• 5+ years of experience in a cybersecurity role, with hands-on ISO 27001 implementation and auditing.
• Certified ISO/IEC 27001 Lead Implementer or Auditor (mandatory).
• Strong understanding of risk assessment, GRC frameworks, and security operations.
• Proficient in tools and technologies such as SIEM, IDS/IPS, vulnerability scanners, and endpoint protection.
• Excellent documentation and reporting skills.
• Bachelor’s degree in Cybersecurity, IT, or a related field; relevant certifications (CISSP, CISA, etc.) preferred.
Originally posted on Himalayas