Staff Information Security Engineer (6584)

About Blackhawk Network

Today, through BHN’s single global platform, businesses of all kinds can tap into the world’s largest network of branded payment solutions. BHN helps businesses grow revenue, increase loyalty, motivate and reward their teams, disburse funds and engage consumers. Branded payment solutions include the issuance and distribution of gift cards, egifts, corporate payouts and rewards, along with the technology to deliver these products in seamless, integrated ways. BHN’s network spans the globe with more than 400,000 consumer touchpoints. Learn more at BHN.com.

Overview

We are looking to hire a Lead Offensive Security Staff Engineer to join the growing Blackhawk Network Global Information Security Team, who will report to the Manager of Information Security.  This position is based in Bengaluru,India with onsite. This position will be tasked with leading and growing the Blackhawk Network Offensive Security Team. The ideal candidate will be a technical self-starter with a passion for breaking ‘all the things’ unbreakable; and working with teams to fix them. The candidate will understand the impact and security decisions that need to be made to keep corporate and production infrastructure secure, and then be able to articulate those to engineers and business teams outside the Security team.

Responsibilities

• Mentor and grow a small, high-impact and multi-talented Offensive Security team
• Work with stakeholders on defining scope, requirements of engagement and performing engagements
• Participate in Offensive Security exercises such as Penetration Testing and Red Team Exercises, physical and virtual
• Perform penetration tests on computer systems, networks, web-based applications, mobile applications and physical locations
• Keep up to date with latest penetration testing and ethical hacking TTPs
• Creating tooling and automation for Offensive Security Team
• Deploy testing methodology and collect data
• Enhance testing methodologies
• Report findings to stakeholders
• Provide guidance on findings for tooling selection and implementation – closing the gap in endpoint and network visibility across the enterprise
• Assist in the development of effecting and efficient internal security policies, procedures and standards
• Work closely with other members of the Security team to test, tune, and deploy security technologies that are scalable and enhance detection and response

Qualifications

• Strong passion for Offensive Security and leading an Offensive Security Team
• 5+ years of experience working on a Red/Purple Team, Penetration Testing Team  or Offensive Security Team for an Enterprise organization  
• Experience with Security Tools such as; Nmap, Metasploit, Kali, Burp, Cobalt Strike, Wireshark, Aircrack-NG, etc. o Understanding of MITRE/PTES Framework, and threat modeling o Exploit creation, scripting and reverse engineering
• Tools in the  Offensive Security – OSINT, Web Application, Network, *nix/Windows/mac Environment, Social Engineering, and Red/Purple Team Engagements
• Understanding of command and control, data exfiltration, and lateral movement techniques o In depth knowledge of OPSEC, evasion and anti-forensics techniques o In depth knowledge of application, network, and system and modern attacker techniques to exploit these vulnerabilities o In depth knowledge of networking fundamentals networking fundamentals, with a deep understanding of TCP/IP and other core protocols
• 3+ years’ experience with a range of security controls for at least  one the following technologies:
• Active Directory o Firewalls o Networking o Cloud Services o Operating Systems – Windows/*NIX/MacOS
• Experience with PCI, SOX, SOC-2, HIPAA, GDPR, NIST and ISO Regulatory Frameworks • Ability to program/script in at least one language; Python, GO, Assembly, Perl, Ruby, C/C#/C++, Java, JavaScript, BASH, PowerShell
• Analytical with strong problem-solving skills and exercises good, balanced decision making
• Excellent written and verbal communication skills
• bility to report and explain findings to a technical and C-level audience