Job details
Job type full-time
Full job description
Job summary:
The primary purpose of this role is to support the implementation and ongoing delivery of information security tools and processesThis includes responsibility for executing and improving processes and procedures with occasional guidance from more senior level security associates.
This role solves complex problems while completing both tactical and non-tactical activities in support of the successful delivery of assigned information security processes.
The individual in this role continues to grow his/her understanding across the various tools and processes supported by the team, including the key integration points with other parts of technologyHe/she receives occasional guidance and direction from more senior level associates on the team.
With a focus specifically on security threat & vulnerability, this role supports the execution of processes focused on vulnerability identification or remediationThis includes information security and risk activities such as oversight of vulnerability assessments and remediation programs serving both internal and external stakeholders.
Key responsibilities:
Conducts internal and external penetration tests using proprietary and open-source tools to identify vulnerabilities and exposure within lowe’s systems and applications
Assist in developing methodologies for continuous enhancements to pentesting methods and processes
Performs hands-on penetration tests of lowe’s enterprise and its infrastructure
Performs network penetration, web and mobile application testing, source code reviews
Develops, researches, and maintains proficiency in tools, techniques, countermeasures, and vulnerabilities trends ranging from data compromise/destruction, covert communications, encryption attacks
Prescribes cybersecurity best practices techniques to address weaknesses in cyber assets and combat sophisticated threats against those assets
Analyzes data to detect trends, make recommendations, and provide reporting, defines reporting requirements for standard reports
Leads activities to assess adherence to the information security processes supported
Collaborates with management to determine information security metrics
Maintains an awareness of information security news and trends
Consolidates security-related findings, tracks kpis, and presents results to information security and business leaders and/or vendors
Researches current technologies to assist in the development of new capabilities and recommends solution options
Facilitates cross-functional (security, technology, business) teams to solve complex problems
Provides insight and consultation to help ensure new and existing security solutions are developed with insight into industry best practices, strategies, and architectures
Makes recommendations for process or technology changes
Develops tools or processes to operationalize/improve workflows
Partners with senior key stakeholders to develop and/or update information security documents such as policies, standards, procedures, training
Minimum qualifications:
Bachelor`s degree in computer science, cis, engineering, business administration, cybersecurity, or related field (or equivalent work or military experience in a related field)
2 years of experience in information security
Basic understanding of fundamental security and network concepts (windows and unix security: os lockdown; logging and monitoring; application security; user access; perimeter protection principles, network communication rules; intrusion detection and analysis methods; etc.)
Preferred qualifications:
Relevant information security certifications (e.g., cissp, cism, ceh, pci isa, crisc, cisa, oscp, gpen)
3+ years penetration testing experience
Ability to analyze and write technical reports
1+ years of programming or scripting language (python, java, bash, powershell)
Familiarity with vulnerability management and penetration testing tools operating system internal functions.
Ability to present/defend positions and build consensus with technical/non-technical personnel across different agencies/organizations.
Ability to translate vulnerabilities into remediation efforts and work with relevant teams
