Manual Ethical Hacker
About The Position
Manual Ethical Hacking is part of the Application Development Security Framework Program within Bank of America’s Cyber Security Assurance Offensive Security group. The program assesses the vulnerability of the bank’s applications to malicious hacking activity. This intermediate technical role performs application security assessments of the bank’s technologies, applications, and cybersecurity controls, adapting testing methods to evolving and emerging threats. The role involves researching threats, understanding bank security policies, coordinating with appropriate partners to complete assessments and simulations, identifying misconfigurations and vulnerabilities, and reporting associated risks. The position works closely with security partners, CIO clients, and multiple lines of business. The role is based at listed Bank of America offices in Denver, Washington, D.C., or Chicago. It is a first-shift position with 40 hours per week. Bank of America describes its work culture as in-office, with office-based attendance requirements and role-specific flexibility.
Requirements
- At least 4 years of professional penetration testing, application security, or ethical hacking experience; experience in a large, complex enterprise environment is preferred.
- Detailed technical knowledge in at least 3 of these areas: security engineering; application architecture; authentication and security protocols; application session management; applied cryptography; common communication protocols; mobile frameworks; single sign-on technologies; exploit automation platforms; or RESTful web services.
- Ability to perform SQL injection and XSS attacks without using tools.
- Experience performing manual code reviews for security-relevant issues.
- Experience using SAST tools to identify vulnerabilities.
- Ability to manually identify and reproduce findings, discuss remediation concepts, develop vulnerability proofs of concept, use scripting or coding techniques, execute common penetration-testing tools, triage and support incidents, and produce high-value findings.
- Experience performing manual web application assessments.
- Knowledge of network and web-related protocols and technologies, such as UNIX/Linux, TCP/IP, and cookies.
- Experience with vulnerability assessment tools and penetration-testing techniques.
- Solid programming and debugging skills.
- Experience using tools including IBM AppScan, Burp, and SQLMap.
- Skills in threat analysis, innovative thinking, technology systems assessment, technical documentation, and advisory.
Nice To Haves
- CISSP, CEH, OSCP, OSWE, GPEN, PenTest+, or a similar certification.
- Strong programming or scripting skills.
- Mobile application analysis experience.
- Experience with Frida.
- Binary analysis and disassembly skills.
Responsibilities
- Analyze internal and external threats to information systems and predict future threat behavior.
- Incorporate threat actors’ tactics, techniques, and procedures into offensive security testing.
- Assess the security, effectiveness, and practicality of multiple technology systems.
- Use innovative thinking to solve problems or introduce ideas applicable to offensive security processes or products.
- Prepare and present detailed technical information through documents, reports, and notifications.
- Provide clear, practical advice regarding managed risks.
- Develop advanced technical and leadership skills and mentor junior assessors in technical tradecraft and soft skills.
- Perform application security assessments, identify misconfigurations and vulnerabilities, and report associated risks.
- Work with appropriate partners to complete assessments and simulations.
Benefits
- Industry-leading benefits.
- Access to paid time off.
- Resources and support for employees.
- Eligibility to participate in the annual discretionary incentive plan, with awards based on individual performance and behavior, line-of-business or group performance and contributions, and overall company success.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
