The Company
 
Hitachi Vantara, a wholly owned subsidiary of Hitachi, Ltd., helps data-driven leaders use the value in their data to innovate intelligently and reach outcomes that matter for business and society – what we call a double bottom line. Only Hitachi Vantara combines 100+ years of experience in operational technology (OT) and 60+ years in IT to unlock the power of data from your business, your people and your machines. We help enterprises store, enrich, activate and monetize data for better customer experiences, new revenue streams and lower business costs
 

The Role

Hitachi Vantara seeks a passionate and talented Principal Penetration Test Engineer to join our Enterprise Security team and partner with Hitachi Vantara business groups to best understand the organization’s needs and how they relate to our global information security posture. In this role you will report to the Director, Security Architecture and will lead the technical scoping of security testing activities and execute penetration testing against Hitachi Vantara products, services and/or infrastructure.

You will be working very closely with the IT and product teams to assess our security, make recommendations, and suggest solutions. Yo will be responsible for uncovering security flaws in a diverse set of technologies. As part of that role, you will communicate observations to the Enterprise Security and Product Engineer teams, endeavor to meet Engineers’ expected outcomes, and ensure the timely delivery of project milestones.
You will have the opportunity to guide our IT and Product Engineers’ long-term security strategy and contribute to the overall growth and maturity of Hitachi Vantara services. You will act independently, as well as collaboratively with engineers, peers, partners, and managers from IT and multiple organizations to ensure technical excellence and satisfaction.

Responsibilities

• Conduct penetration testing across Hitachi Vantara products(Web/Thick client/Mobile/API), services, public cloud environment (Azure, AWS and GCP) and/or infrastructure.
• Serve as the security SME for penetration testing.
• Conduct vulnerability research and utilize off-the-shelf exploits.
• Be a master of identifying security design gaps in existing and proposed architectures and recommend changes or enhancements.
• Engage at all point of Software Engineering project to ensure Security controls and proper risk management practices are implemented including secure coding, code review, code application scanning as part of the quality process.
• Lead root cause analysis processes based on information about the engineering groups processes, technology, and maturity.
• Lead cross functional project calls and planning sessions.
• Communicate across functional areas and update project statuses to keep project teams informed of progress and/or significant changes.
• Demonstrate ability to successfully distill complex technical information into clear, concise yet comprehensive communication material.
• Understand the fundamental company security and risk management strategy and be able to apply that as fundamental pillar of the transformation strategy.

Requirements

• At least Bachelor’s degree.
• Minimum 7 years of penetration test including a fair degree of security engineering knowledge.
• Experience with security testing tools (Burp suite, Appscan, WebInspector, SQLMAP, Kali, etc.).
• Experience with securing public cloud deployments and distributed systems using public cloud hosting, including GCP, AWS or Azure.
• Conduct vulnerability research pertaining to AWS, Azure or GCP relevant technologies.
• Experience writing automation to help scale security testing at AWS.
• Ideally an industry recognized certification: OSCP, OSCE or alternative.
• In depth knowledge of threat model, network security, cryptography, authentication and authorization.
• Experience with implementing common security frameworks and controls in highly automated environments, especially in CI/CD environments.
• Knowledge of Docker, Kubernetes Pentesting and Implementation of hardened Docker, Orchestration, Images.
• Big Data Penetration Testing, and knowledge in hardening techniques for services like hdfs, druid, s3 data lakes, ranger, and others.
• Penetration testing of hardware, storage Controllers, object based and block based storage devices, chipsets, understanding of security best practices for physical hardware, chipsets, networking protocols, encryption, etc.
• Strong understanding of application security patterns including web application security (OWASP top 10, XSS, injection vulnerabilities, CSRF, platform security hardening), and mobile security (device fingerprinting, Mobile authentication and key exchange) strategies.
• Expertise in developing and implementing one or more of the following: Identity and Access Management, SSO, SAML, Open ID, OAuth2 or 2FA technologies.
• An ability to script or customize attack code as needed is a plus.
• Ability to assist in coding of custom automations of security tasks is a plus.
• Able to communicate risks and recommendations to Senior Leadership and management.
• Demonstrate leadership, including the ability to influence all levels of management towards a common goal.
• Ability to facilitate meetings with strong presentation skills and ability to quickly discern differing points of view versus derailing points of view.

We are an equal opportunity employer. All applicants will be considered for employment without attention to age, race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status.

#LI-AM2