Cloud Security Red Team Citi
New York, NY

Job Description

* Primary Location: United States,New York,New York
* Education: Bachelor's Degree
* Job Function: Technology
* Schedule: Full-time
* Shift: Day Job
* Employee Status: Regular
* Travel Time: No
* Job ID: 19034209

Description

Who are we?

Citi Technology Infrastructure (CTI) provides the products and services that enable Citi's workforce, along with the majority of the financial solutions that Citi's customers rely on. We provide the critical technical foundation for Citi's operations through the infrastructure that runs business and general user computing services. We do this by working as one-team to deliver high quality, reliable and modern infrastructure technologies at the right cost. We drive to optimize the functionality and capability of the infrastructure technologies.

About the Position:

The Cloud Security Red Team is a multi-disciplinary team of teams driving cyber security operational services and solutions to enable Citi to securely adopt private, hybrid, and public cloud platforms. Operating model emphasizes automation, integration, and agility based on Security as a Service / Security as Code concepts. Red Team is one of the primary interfaces with development teams, architects, engineers, and operational teams involved in cloud projects. The Red Team also performs global intelligence-led exercises against people, process, and technology to improve Citi's security posture. The Red Team challenges the organization to improve the effectiveness of Cyber Security by conducting exercises using the same Tactics, Techniques and Procedures (TTPs) as real adversaries.

To be successful in this role, candidates are expected to act as subject matter experts in offensive security with a proven track record in exploitation, escalation of privileges, and lateral movement with an emphasis on Cloud environments.

Day-to-Day Responsibilities:

* Conduct global Red Team adversary simulations
* Conduct vulnerability assessments and penetration tests (application and/or infrastructure) and articulate security issues to technical and non-technical audience
* Identify, research, and validate known and unknown exploits on Cloud environments
* Work closely with the Blue Team to identify gaps, address findings, and improve breach response in Cloud environments
* Develop/Deploy/support Application & Infrastructure Security Checks, Gates, and guardrails throughout the lifecycle (pre-commit, commit-time, build-time, acceptance, Prod/Post-production checks)

Qualifications

Technical Skills:

Candidates should have knowledge of the tools and processes used to expose known and undocumented vulnerabilities in various different systems. Pre-requisites for this position are at least a Bachelor's Degree with 3 - 7 years of experience on most of the following areas:

* Vulnerability Assessment tools
* Exploitation frameworks
* Post-Exploitation frameworks
* Cloud security in various Cloud Service Providers (AWS, GCP, Azure)
* Social Engineering and OSINT campaigns, e.g. email phishing, phone calls, SET
* Exploitation modification and development
* Security devices, e.g. Next-Gen Firewalls, VPNs, AAA systems
* OS Security, e.g. Unix, Linux, Windows, Cisco
* Web development and/or programming languages, e.g. Python, Perl, Ruby, Java, and/or .Net

Industry-accredited security certifications will be required. Candidates with information security certifications such as: OSCP, OSCE, GXPN, GPEN, GCIH, and GWAPT will be preferred, as well as Cloud-related certifications from Amazon, Google, and Microsoft. Candidates without certification must be willing to purse them during the course of employment.

Apply Now