Red Team Security Specialist

This role reports to the Head of Information Security and requires a fast-learning and self-motivated individual to add capability and capacity to our small but highly effective team. Information Security is evolving to dynamic business needs, a rapidly changing threat environment, and the firm's own ambitious IT Strategy. This role will help play a key part in implementing and improving the underlying processes required to provide a structured, systematic, and audited approach to Information Security across the firm.

Responsibilities

Conduct thorough Red Team offensive penetration testing on IT (on prem and cloud) infrastructure to identify vulnerabilities and provide recommendations for remediation; Perform security assessments on cloud-based applications, ensuring they adhere to industry standards and best practices; Execute red team exercises to simulate real-world attack scenarios, testing the firm's detection and response capabilities; Assess and test the security of internally deployed infrastructure IoT devices and sensors; Assess and test the SmartBuilding digital landscape and data lake; Assess and test web-based APIs and applications for vulnerabilities and recommend actions to resolve them; Provide guidance to internal teams on API security testing and secure practices, and carry out API security assessments; Work with stakeholders on developing testing models for Generative A.I security; Collaborate with cross-functional teams to implement security measures and enhance the firm's overall security posture; Prepare detailed reports and presentations on findings for technical and non-technical stakeholders; Stay informed about the latest security trends, threats, and technologies; Assist in developing and maintaining security policies, procedures, and guidelines; Serve as the key point of contact for all matters related to security testing engagements; Support certification activities such as ISO27001, SOC2, and Cyber Essentials Plus; Participate in the evaluation, selection, and implementation of security testing technologies; Engage with security industry groups and external industry partners

Requirements

Comprehensive experience and knowledge in security testing and red teaming; Background in information security; Ability to conduct a wide range of security testing and red teaming activities; Ability to provide advice and guidance to the business; Ability to quickly assimilate information to assess and document risks; Ability to engage with individuals at various levels of seniority; Ability to balance the need to gather information; Ability to demonstrate how Information Security aligns with business objectives and client information assurance needs; Organised approach to managing and prioritising multiple concurrent assignments; Experience in developing and using structured documentation (process, format, logical content, version control); Ability to maintain good working relations with external clients; Degree-level education is likely but not essential

Nice to have

CREST status; CHECK status; OSCP; OSWE; OSWA; Various qualifications; Full membership status with the IISP; Possibility of future security clearance requirement

Benefits

Varied opportunities to grow and develop skills and knowledge; Formal training, informal coaching and mentoring; Skills-based and technical training; On-the-job learning; Broad range of benefits including financial, wellbeing, lifestyle, and family-friendly benefits; Hybrid working