Manual Ethical Hacker

Bank of America•Denver, CO

6h•Onsite

About The Position

Manual Ethical Hacking is part of Bank of America’s Application Development Security Framework Program within the Cyber Security Assurance Offensive Security group. The program assesses the vulnerability of the bank’s applications to malicious hacking activity. This intermediate technical role performs application security assessments of the bank’s technologies, applications, and cybersecurity controls, adapting testing methods to evolving and emerging threats. The role involves researching threats, understanding security policies, coordinating with partners to complete assessments and simulations, identifying misconfigurations and vulnerabilities, and reporting associated risks. The position works closely with security partners, CIO clients, and multiple lines of business.

Requirements

At least 4 years of professional penetration testing, application security, or ethical hacking experience; preferably in a large, complex enterprise environment.
Detailed technical knowledge in at least three of the following areas: security engineering; application architecture; authentication and security protocols; application session management; applied cryptography; common communication protocols; mobile frameworks; single sign-on technologies; exploit automation platforms; or RESTful web services.
Ability to perform SQL injection and XSS attacks without using tools.
Experience performing manual code reviews for security-relevant issues.
Experience using SAST tools to identify vulnerabilities.
Ability to manually identify and reproduce findings, discuss remediation concepts, develop vulnerability proof-of-concept exploits, use scripting or coding techniques, proficiently operate common penetration-testing tools, triage and support incidents, and produce high-value findings.
Experience performing manual web application assessments.
Knowledge of network and web-related protocols and technologies, such as UNIX/Linux, TCP/IP, and cookies.
Experience with vulnerability-assessment tools and penetration-testing techniques.
Solid programming and debugging skills.
Experience using tools including IBM AppScan, Burp, and SQLMap.

Nice To Haves

CISSP, CEH, OSCP, OSWE, GPEN, PenTest+, or a similar certification.
Strong programming or scripting skills.
Mobile application analysis experience.
Experience with Frida.
Binary analysis and disassembly skills.

Responsibilities

Analyze internal and external threats to information systems and predict future threat behavior.
Incorporate threat actors’ tactics, techniques, and procedures into offensive security testing.
Assess the security, effectiveness, and practicality of multiple technology systems.
Use innovative thinking to solve problems or introduce ideas applicable to offensive security processes or products.
Prepare and present detailed technical information through documents, reports, and notifications.
Provide clear, practical advice regarding managed risks.
Develop advanced technical and leadership skills.
Mentor junior assessors in technical tradecraft and soft skills.
Perform manual application security assessments, code reviews, and penetration testing; identify and reproduce findings, discuss remediation concepts, develop proof-of-concept exploits, and report high-value findings.
Use scripting and coding techniques, penetration-testing tools, and vulnerability-assessment tools; triage and support incidents.