استخدام security assessment tech lead

توضیحات آگهی

Leadership Governance
Lead coordinate and mentor the team of security assessors and auditors and prioritize their workload across multiple concurrent engagements
Establish and maintain the security audit governance framework checklists assessment methodologies scoping rules review procedures approval workflows evidence requirements and reporting standards
Review and approve audit scopes evaluation criteria and assessment plans
Ensure consistency and quality across all audit and assessment deliverables
Support continuous improvement of the team s methodologies tooling and processes
Vulnerability Assessment Penetration Testing
Plan coordinate and oversee penetration tests and vulnerability assessments of web applications mobile applications Android iOS APIs and infrastructure
Perform architectural analysis and security design reviews to identify weaknesses and risks early
Review technical findings for accuracy reproducibility and correct risk rating before they are communicated to stakeholders
Hands on involvement in testing where needed especially for complex or high risk targets
Security Control Audits
Plan and supervise audits of security controls across infrastructure applications and processes e g access control network security patch and vulnerability management logging and monitoring change management
Assess the design and operating effectiveness of controls against internal policies and standards such as ISO IEC 27001 NIST CIS Benchmarks and applicable regulatory requirements
Identify compliance gaps control weaknesses and recurring non conformities and recommend improvements
Define evidence requirements and ensure audit evidence is properly collected documented and retained
Reporting Remediation Follow up
Prepare review and approve audit and penetration testing reports ensuring that findings risks evidence and recommendations are clear and actionable
Communicate findings and risks to technical teams system owners and senior management
Track all findings through to closure assign corrective actions follow up on deadlines and verify remediation
Escalate unresolved or overdue risks to the relevant stakeholders and management
Provide regular status and progress reports on open risks remediation plans and audit actions
Identify recurring weaknesses across systems and teams and recommend improvements to controls processes and development practices
Stakeholder Collaboration
Work closely with development infrastructure security operations and management teams to understand security requirements and ensure risks are addressed
Provide remediation guidance to development and infrastructure teams
Coordinate with stakeholders to obtain evidence clarify findings and resolve disagreements constructively
Requirements
Proven experience in security assessment penetration testing vulnerability management and or security auditing
Experience leading or coordinating a security assessment or audit team
Hands on experience performing both technical security testing and control or compliance audits
Strong understanding of security governance risk management audit processes and security controls
Solid knowledge of common attack techniques and application infrastructure and mobile security concepts
Familiarity with OWASP Top 10 OWASP MASVS MASTG and other relevant standards and frameworks ISO 27001 NIST CIS
Practical knowledge of penetration testing methodologies and risk rating approaches e g CVSS
Familiarity with tools such as Burp Suite OWASP ZAP MobSF MitMProxy Nmap Nessus OpenVAS and similar
Familiarity with mobile technologies and languages Java Kotlin Swift Objective C React Native Xamarin is a plus
Ability to develop review and approve audit checklists and assessment criteria
شرکت ویستا سامانه آسا ASA
دسته بندی IT DevOps Server
نحوه همکاری تمام وقت
نوع همکاری حضوری
مدرک تحصیلی مهم نیست
سابقه کار سه تا شش سال
حقوق توافقی
جنسیت مهم نیست
مهارت ها Security Development
شهر تهران تهران