Redbot Security is Hiring!
Join our Team and join our mission – Securing our Nation’s most critical infrastructure
Redbot Security provides industry leading manual penetration testing and full-service security services. Our team of Senior Level Engineers are fully certified ethical hackers. We specialize in controlled, manual exploitation of Wireless, Internal, External, Application, Cloud, ICS/SCADA Penetration Testing and provide the industry’s best customer experience, scoping and service delivery.
Senior-Level Penetration Tester
Manual Controlled Penetration Testing Position
Job Description
Redbot Security provides industry leading manual penetration testing and full-service security services. Our team of Senior Level Engineers are fully certified ethical hackers. We specialize in controlled, manual exploitation of Wireless, Internal, External, Application, Cloud, ICS/SCADA Penetration Testing and provide the industry’s best customer experience, scoping and service delivery.
Job Overview
Redbot Security is looking for a senior-level penetration tester. This role requires the person to “hit-the-ground-running” with performing penetration testing for the web applications, internal/external networks, cloud environments, wireless networks, and mobile devices in addition to being able to perform social engineering using electronic and physical methods.
The senior-level penetration tester would start out as a contractor performing penetration testing with contract-to-hire opportunities later after a probationary period has passed.
Work Location
- Fully Remote
Essential Responsibilities
- You will be called on to perform technical testing against a variety of targets. These include:
- External Networks
- Internal Networks
- Wireless Networks
- Web Applications and APIs
- Mobile Devices / Applications
- Cloud Environments
- Social Engineering (on-premise and electronic)
- Firewalls (Firewall Review)
- SCADA Networks (*Bonus points if knowledgeable)
- IoT Devices (*Bonus points if knowledgeable)
- Grow to support all security practice offerings in a pre-sales and post-sales role
- Meet professional practice standards and demonstrate exceptional skill in core service areas
- Develop and maintain positive relationships with clients
- Execute delivery work that exceeds expectations
- Understand the client’s business and needs
- Participating in industry conferences and professional organizations
- Creating additional value for clients through continual insights and consultative advice based on experience with the client, their industry, established standards and leading practices
- Help to assist and to teach peers
- 4+ years in an active penetration testing role. This is a Senior-level role and requires previous pen testing experience. (Penetration Testing performed as a service in lieu of penetration testing for your own organization is preferred)
- Previous IT experience that isn’t security (e.g., network/sysadmin or web developer)
- Certifications such as GPEN, GXPN, GMOB, GWAPT, OSCP, OSWE, OSCE, OSEE, OSWP
- Strong knowledge of the following:
- Network administration
- System administration (Windows / Linux)
- Modern penetration testing tools and methods
- Firewall reviews
- Web-based application security concepts
- Cloud services (GCP, AWS, and Azure)
- IEEE 802.11 security concepts
- Windows/Linux/UNIX internals
- Internet protocol suite
- Experience using interpreted languages (Python, PHP, etc.)
- Knowledge of compiled languages (Java, C, C++, Assembly, etc.)
- Social engineering techniques and tactics
- Strong written and verbal skills
- Be able to work and interact with clients of various backgrounds
- Maintain positive client relationships and feedback
- Be comfortable explaining findings and recommendations to technical and non-technical audiences
- Knowledge of common regulatory structures and obligations
- Knowledge of common I.T. governance guidance
- Background Check Required
- Previous experience working as a systems administrator
- Previous experience working as a network administrator
- Previous experience working as a web developer
- Previous technical security consulting experience
- Fundamental or advanced understanding of SCADA systems
- Bachelor’s degree or foreign equivalent in Engineering, Computer Science, MIS, CIS or related field
- Contributions and participation in the security community.
- Experience presenting at security conferences.
- GitHub project repositories.
- Developed or maintained security tools.
- Expertise in developing exploits
- Published CVEs.
- Participation in CTFs.
Tell us about yourself
Redbot News and Insight
LATEST CYBER NEWS
The CrowdStrike Incident: Proof Critical Infrastructure is not Prepared for Real Cyber Threats
Our nation is under attack and overwhelmed. Modern Security teams face numerous challenges in managing network and application security effectively.
Overcoming the Struggles of Cybersecurity Management
Our nation is under attack and overwhelmed. Modern Security teams face numerous challenges in managing network and application security effectively.
Beyond the Top 5: ICS/SCADA IT/OT Security
Is your security team sharing sensitive data unknowingly?
Navigating Cybersecurity Threats with Monte Carlo Simulations and LLMs
Through repeated random sampling, allows us to simulate a wide array of social engineering attacks with a depth and breadth previously unimaginable.
Evolving Your Cybersecurity: From Penetration Testing to Red Teaming
While penetration testing is valuable in identifying technical vulnerabilities, red teaming provides a more holistic assessment by simulating realistic threat scenarios. By embracing red teaming, organizations can bolster their defenses, uncover weaknesses, and stay one step ahead of sophisticated adversaries.
A Penetration Tester’s Perspective on OSINT
Malicious actors leveraging OSINT to uncover confidential and sensitive information that is publicly available online. Learn how to prevent risks.
From an Attacker’s Perspective: Client-Side Desync
Client-side desyncs are a class of browser-powered HTTP smuggling attacks. What you need to know and how to prevent a malicious actor from taking advantage of this vulnerability.
NTLM relaying attack – Taking complete control
Active Directory Certificate Services (AD CS) presents various security risks for organizations. This article will help you understand a Relay Attack.
Application Penetration Testing – Offensive Security
What is an API? APIs, including local and remote, come in various forms and are fundamental to modern software development. They serve as the bridge between different software components, enabling them to work together seamlessly.
Examining the Modbus Protocol from an Offensive Security Perspective
While plenty of articles cover the Modbus protocol with varying degrees of detail and usage, this article aims to examine the Modbus protocol with an offensive security lens.
The Impact of Recent Cybersecurity Layoffs: Evaluating the Risk of a Serious Cyber Attack
Recent reports of significant cybersecurity layoffs in the United States have raised concerns about the nation's preparedness to defend against cyber threats
Machine Learning & Artificial Intelligence
Machine Learning (ML) is a subset of AI, and, more than likely, closely aligns with what we consider to be AI in the media.
ICS/SCADA Penetration Testing: Where to Start
Becoming proficient in Operational Technology (OT), Industrial Control Systems (ICS), and Supervisory Control and Data Acquisition (SCADA) network testing can appear daunting as there are fewer learning resources.
AS-REP Roasting
Kerberos Authentication Service Response (AS-REP) Roasting, a technique similar to Kerberoasting, has gained prominence as a method for attackers to compromise Active Directory (AD) authentication systems.
PHP Insecure Deserialization
Attackers can manipulate the serialized data to execute malicious code, compromise the application, or gain unauthorized access.
Mass Assignment Vulnerabilities
Mass Assignment Vulnerability occurs when a web application allows users to submit a more extensive set of data than is intended or safe. The potential consequences of this vulnerability can be severe
Insecure Direct Object Reference (IDOR)
Insecure Direct Object Reference (IDOR) vulnerabilities pose a significant risk to the security of web applications, allowing attackers unauthorized access to sensitive data and functionalities. By understanding the implications of IDOR and adopting secure coding practices, web developers can protect their applications and users from potential exploitation.
Redbot Security: Disrupting the Penetration Testing Sector with Differentiating Strategies
Among the companies spearheading the transition to a more secure world is Redbot Security. GRC View Point Top-Ten Penetration Testing Firms.
Android Malware
The likelihood of a cyber attack on a mobile platform is significantly high, but how difficult is it for a malicious actor to generate malware? You might be surprised.
Security Incidents Involving Family Members
Should an Employee Report Security Incidents Involving Family Members? Is your business or job at risk if a bad actor gets access to your family. Will they gain access to you?
Top Cybersecurity Companies
List of top cybersecurity companies with summary information and links to sites
Attack Surface Management (ASM)
Today, cybercriminals have plenty of entry points to exploit. Therefore, it has become crucial for organizations to improve their attack surface visibility to have more effective protection. This is where attack surface management (ASM) comes into play. This article will explore all about attack surface management (ASM), including its importance, working principle, and benefits.
Top 5 Cybersecurity Red Team Service Providers
The following article is a discussion that explores the industry's top Red Team Service Providers
Top Penetration Testing Companies
Best Penetration Testing Companies and Top Rated Pen-testing Service Providers with Detailed Cost and Service Reviews. List of Top Penetration Testing Companies with monthly updates
Top Rapid7 Alternatives: Penetration Testing Services
The following article is a discussion that explores Wave Behaviors to Locate Wireless Access Points and Devices
Network Security for Small Business
Complete Network Security for Small Business Many small businesses grow rapidly and have to adhere to the same best practices that larger companies deploy to protect
Offensive Security
What is Offensive Security? Discover Offensive Security and learn how Offensive Security can help strengthen your cybersecurity posture. Links to tools.
Wireless Penetration Testing Services
The following article is a discussion that explores Wave Behaviors to Locate Wireless Access Points and Devices
Application Security – JavaScript Web Tokens
The following article is a discussion that explores JavaScript Web Tokens
What is Social Hacking?
Social hacking is an attack on the human operating system, which tries to exploit the vulnerabilities in the human OS mostly related to authority, trust, or fear. To help better understand how social hacking works, let's take its most common form the phishing email (scam email) and see how it works.
From Military Cyberwarfare to Commercial Pen Testing
The following article is a discussion about helping you to best utilize your military skills to successfully transition into the commercial space.
Microsoft Windows Laptop Security
Malicious actors prey on weak configurations like locusts. Microsoft, despite knowing that their operating systems, have inherent weaknesses have done little to enhance their initial security outside of remediation for publicly known vulnerabilities.
What is Penetration Testing & Its Different Types
Manual Penetration Testing is essential for critical infrastructure. Scanning for vulnerabilities within ICS/SCADA networks without improper supervision can cause many systems to be overwhelmed and go offline. The potential consequences of disrupting critical systems is great.
Common cybersecurity issues that are easy to fix
Most companies know that critical vulnerabilities can be resolved simply by updating critical security patches. However, more often than not, many systems across multiple client sectors are found to be using obsolete operating systems and missing patches such as the MS17-010 critical security update.
Manual Penetration Testing – Manual Testing vs Automated Testing
Manual Penetration Testing is essential for critical infrastructure. Scanning for vulnerabilities within ICS/SCADA networks without improper supervision can cause many systems to be overwhelmed and go offline. The potential consequences of disrupting critical systems is great.
Our Nation Under Attack
The basic necessities of life; water, power and transportation are threatened by lack of resources to protect the systems that provide our nation’s basic needs. Nation State Threat Actors are aggressively ramping up efforts to take our country down by targeting Industrial control systems and outdated SCADA systems.
What You Need to Know About PCI Penetration Testing
A pen test, on the other hand, is a manual process. It actively seeks vulnerabilities in the system and exploits them as hackers would. Because it is a thorough process, it provides more comprehensive results. It is carried out less often than a vulnerability scan; usually once a year.
What is Penetration Testing (pen-testing)?
Penetration testing (pen-testing) is the art and science of identifying a company's security vulnerabilities and potential weaknesses using simulated real world hacker techniques. Learn more about penetration testing and how it's the perfect security measure to prevent cyber attacks.
How to Select the Best Penetration Testing Company for your Project
How to evaluate penetration testing companies, budget and how best to move forward with the right company or individual who specializes in ethical hacking.
Redbot Security – Network Security Tools: Penetration Testing
Redbot Security Network Security Tools - Penetration Testing. Is it time to attack yourself? Protecting your network and data 24/7 is a big challenge. Despite your
Is Security Information Event Management (SIEM) Dead?
Is Security Information Event Management (SIEM) Dead? Yes, yes it is. The Noise Security information and event management known as SIEM provides network administrators security logs
Do I need a Penetration Test, Can I do it myself?
Do I need a Penetration Test, Can I do it myself? We’ve all been to the doctor and had our blood drawn. The tests come back
A Great Career in Cyber Security
Opportunities in Cyber Security Thinking of a career change? Think cybersecurity. If you are wondering if cybersecurity is a good career move, the statistics are definitely in
Cyber Risk and Old Shoes
Cyber Risk and Old Shoes I hate to admit it, but I've had the same sneakers for about 4 years, and I walk faithfully every day, rain
Penetration Testing vs Vulnerability Scanning
Penetration Testing vs Vulnerability Assessments As more organizations become aware of the need for cyber security, the amount of confusion over what products and
Redbot Social