网络安全与渗透测试负责人
Cybersecurity & Pentesting Lead
我们正在寻找一位网络安全与渗透测试负责人，通过风险管理、控制实施、技术分析、授权渗透测试以及采用NIST、CIS、ISO 27001/27002、MITRE ATT&CK和MITRE ATLAS等框架，持续加强Periferia IT Group及其客户的网络安全态势。
该职位涉及设计和执行企业及客户的网络安全策略，协调紫队演练，管理漏洞，并支持审计和认证。
✅ 要求与经验
学术背景
· 系统工程、通信、网络安全或相关领域的专业学位。
所需经验
- 在进攻性安全、风险管理或安全架构方面有5年以上经验。
- 有为客户进行评估并向高级管理层汇报结果的经验。
- 有在受监管行业和混合或多云环境工作的经验为佳。
专业知识
- 熟悉网络、操作系统、云、API、DevSecOps、IAM、密码学和应用安全。
- 有PTES、OWASP Testing Guide、OWASP ASVS和CVSS方法的经验。
- 熟练掌握以下框架：NIST CSF、NIST SP 800-53、CIS Controls、ISO 27001/27002、MITRE ATT&CK、MITRE ATLAS。
技术工具
- 主要：进攻性安全/渗透测试。
- 相关：NIST / ISO 27001 / MITRE ATT&CK / MITRE ATLAS / OWASP。
🔧 主要职责
- 网络安全策略：设计并执行企业及客户的网络安全策略。评估风险、控制缺口、技术暴露和安全成熟度。
- 渗透测试与技术评估：为网页、API、移动设备、基础设施、云、无线网络和内部环境规划并执行渗透测试。定义行动规则、范围、授权、风险标准和证据处理方式。
- 报告与沟通：准备包含可复现发现、影响、证据和优先建议的执行和技术报告。向高级管理层和客户汇报结果。
- 紫队与威胁狩猎：使用MITRE ATT&CK协调紫队、威胁狩猎和控制验证演练。使用MITRE ATLAS评估人工智能和机器学习的风险。
- 漏洞与控制管理：根据CIS Controls、NIST CSF、NIST SP 800-53、ISO 27001/27002和OWASP实践实施并衡量控制措施。管理漏洞、处理计划、例外情况和
查看英文原文
We are looking for a Cybersecurity & Pentesting Lead to lead the continuous strengthening of the cybersecurity posture of Periferia IT Group and its clients, through risk management, implementation of controls, technical analysis, authorized pentesting, and adoption of frameworks such as NIST, CIS, ISO 27001/27002, MITRE ATT&CK, and MITRE ATLAS.
This role involves designing and executing the corporate and client cybersecurity strategy, coordinating purple team exercises, managing vulnerabilities, and supporting audits and certifications.
✅ Requirements & Experience
Academic Background
· Professional degree in Systems Engineering, Telecommunications, Cybersecurity, or related fields.
Required Experience
- 5+ years of experience in offensive security, risk management, or security architecture.
- Experience leading assessments for clients and presenting results to senior management.
- Desirable: Experience in regulated sectors and hybrid or multi-cloud environments.
Specific Knowledge
- Practical knowledge of networks, operating systems, cloud, APIs, DevSecOps, IAM, cryptography, and application security.
- Experience with PTES, OWASP Testing Guide, OWASP ASVS, and CVSS methodologies.
- Proficiency in frameworks: NIST CSF, NIST SP 800-53, CIS Controls, ISO 27001/27002, MITRE ATT&CK, MITRE ATLAS.
Technologies
- Main: Offensive Security / Pentesting.
- Associated: NIST / ISO 27001 / MITRE ATT&CK / MITRE ATLAS / OWASP.
🔧 Main Responsibilities
- Cybersecurity Strategy: Design and execute the corporate and client cybersecurity strategy. Assess risks, control gaps, technology exposure, and security maturity.
- Pentesting & Technical Assessments: Plan and perform pentesting for web, API, mobile, infrastructure, cloud, wireless networks, and internal environments. Define rules of engagement, scope, authorizations, risk criteria, and evidence handling.
- Reporting & Communication: Prepare executive and technical reports with reproducible findings, impact, evidence, and prioritized recommendations. Present results to senior management and clients.
- Purple Team & Threat Hunting: Coordinate purple team, threat hunting, and control validation exercises using MITRE ATT&CK. Assess artificial intelligence and machine learning risks using MITRE ATLAS.
- Vulnerability & Control Management: Implement and measure controls based on CIS Controls, NIST CSF, NIST SP 800-53, ISO 27001/27002, and OWASP practices. Manage vulnerabilities, treatment plans, exceptions, and remediation tracking.
- Monitoring & Response: Define monitoring, incident response, continuity, and recovery capabilities.
- Audits & Certifications: Support audits, certifications, commercial processes, and client meetings.
- Documentation & Methodologies: Keep methodologies, templates, playbooks, evidence, and knowledge base up to date.
- Security Culture: Promote security culture through technical and executive training.
🧠 Skills & Competencies
- Leadership of cybersecurity teams.
- Analytical thinking and attention to detail.
- Effective communication with technical and executive stakeholders.
- Risk management and decision-making under pressure.
- Proactivity and sense of urgency.
- Ability to mediate disagreements and manage expectations.
- Results-oriented and continuous improvement mindset.
- Knowledge of international standards and regulations.
🏢 About the Opportunity
You will be part of Periferia IT Group, an organization focused on digital transformation and cybersecurity, where you will have the opportunity to lead high-impact initiatives, interact with clients in regulated sectors, and strengthen the security posture of the organization and its clients.
Originally posted on Himalayas