Who we want:
Self-directed imitators - people who take ownership of their work and need no prompting to drive productivity, change, and outcomes.
Curious learners - people who seek out cutting-edge research and information to expand and enhance their ability to develop new ideas into reality and to be ready for what’s next.
Analytical problem solvers - people who go beyond just fixing to identify root causes, evaluate optimal solutions, and recommend comprehensive upgrades to prevent future issues.
Job description
The it lead red team analyst provides a proactive evaluation of the stryker digital landscape for vulnerabilities on an ongoing basis.
As the it lead red team analyst, you are expected to have a strong understanding of multiple security domainsThe lead red team analyst is a role that works closely with teams throughout information security, as well as provides technical leadership and advice to teams and leaders throughout stryker.
The red team performs real-world threat emulation with the continued goal of improving organizational readiness, providing advanced simulation for defensive teams, and assessing current control performance for critical stryker assets.
What you will do:
Lead and oversee all red team development and operations within stryker’s infrastructure with clear understanding and adherence to all corporate policies, mission statements, and compliance laws (regulatory, government, etc.).
Research, recognize and exercise modern attacker methodologies, tactics, and the overall process.
Research and verify known attacks, exploits, and security weaknesses using researched and/or developed custom tools.
Leads focus of red team operations and development within ethical hacking methodologies from kickoff to remediation, mentoring less experienced staff.
Work with application and system stakeholders to create and rules of engagement (roe) documents to approve, authorize, and contract agreements on critical implementation issues necessary to execute engagements against stryker’s infrastructure.
Develop accurate comprehensive reports and presentations for both technical and executive audiences that assist all other security team colleagues with driving cybersecurity priorities and investments using an outcome-driven approach that balances investment and risk with the business needs.
Leads and drives red team development of scripts, tools, or methodologies to enhance stryker’s red teaming operations and development.
Analyze and define information system security issues, compliance needs, and requirements-driven to recommend blue team solutions by engaging and or participating in purple team type exercises.
On occasion assists with penetration tests and security assessments from kickoff to remediation, mentoring less experienced staff.
Effectively communicate findings and to stakeholders, including technical staff, executive leadership, and legal counsel.
Proactively reviewing and conducting assessments and trending of innovative new security technologies to improve the security efforts across stryker.
Drive and steer security projects and programs which are in line with global security services strategy
Align security solutions with business strategies, working primarily with line management and it business partners.
Ensure business security deliverables are aligned with stryker’s global strategy and intervene when appropriate
What you need
Bachelor`s degree or equivalent professional experience required.
Bs in computer information systems preferred.
Security certifications ce|h is required and other certifications such as gwapt, offensive security, cissp, cism, or giac are preferred.
4+ years of networking, application, and/or other information systems security experience is required.
Demonstrated ability to work on multiple projects with knowledge of project management methodologies required.
1-3 years of experience directly managing projects highly preferred.
Experience with internal and external network penetration testing, vulnerability assessments, and/or building, securing, and manipulation of network infrastructure is required.
Experience with building, securing, assessing vulnerability, and/or penetration testing internal/external web and other extranet type applications is required.
Basic knowledge in mobile and/or web application management and security assessments.
Experience with email, phone, or physical social engineering security assessments.
Experience with high value asset (hva) and/or crown jewel assessments.
Comprehensive understanding of application (http, smb, etc.) and network (ethernet, tcp/ip, etc.) protocols.
Mastery of windows/mac/linux/unix/ operating systems, including bash and powershell.
Thorough understanding of network protocols, covert channels, and encryption protocols (ssl, tls, etc).
Basic operational knowledge of a variety of applications, database, web server, html, and how implemented.
Basic knowledge of security testing standards, projects, and programs (owas, stvm, etc).
Experience reverse engineering malware, data obfuscators or ciphers.
Understand and execute automation with shell scripting of basic tasks using perl, python, ruby, or batch, etc
Knowledge to develop and interpret standards, policies, procedures, and strategies governing the planning and delivery of security solutions.
#li-remote
`this job may be performed remotely from anywhere in the united states, except that this job may not be filled or performed in colorado.”
