1 day ago
Remote, United Kingdom or Birmingham, United KingdomStaff+
Responsibilities
- Lead security engineering and security testing efforts across Kainos Platforms and Services.
- Set direction for security testing methodology, engagement scoping, outputs, and tool and technology selection.
- Secure web applications and cloud platforms and perform and document manual or automated penetration tests on web applications, networks, and computer systems.
- Assess application and infrastructure source code from a security perspective.
- Promote continuous security, continuous integration, and continuous delivery practices throughout the software development lifecycle.
- Conduct threat-modeling exercises and workshops and communicate security threats and risks to varied audiences.
- Educate customers, Kainos colleagues, and the wider security community on good security practices.
- Manage, coach, mentor, and develop a small number of staff, including supporting performance and career development.
- Work with external penetration-testing companies to translate report findings into actionable tasks.
Requirements
- Expertise securing web applications and cloud platforms such as AWS or Azure.
- Expertise testing software and infrastructure security with manual or automated security tools.
- Expertise assessing software and infrastructure source code for security issues.
- Knowledge of international security standards and regulations including NCSC, NIST, CIS, PCI, GDPR, OWASP ASVS, HIPAA, and SOC 2.
- Knowledge of common cyber security attack vectors including OWASP Top 10, SQL, XSS, XXE, and MITM.
- Ability to articulate threats and risks through threat-modeling exercises and workshops.
- Good programming or scripting experience across Windows, Linux, and macOS.
- Demonstrated ability to manage, mentor, and coach team members and the wider community.
- Ability to stay current with new threats and attack types.
- Desirable qualifications include OSCP, CREST, TIGER, or equivalent penetration-testing certifications.
- Desirable experience includes security tools such as Burp Suite, OWASP-ZAP, Nmap, Nessus, Kali, and Metasploit.
- Knowledge of cyber security areas including OSINT, network scanning, enumeration, sniffing, session hijacking, social engineering, firewalls, honeypots, IDS, IPS, WAF, antivirus, DLP, cryptography, PKI, IoT threats, trojans, viruses, worms, backdoors, and ransomware.
- Active participation in knowledge-sharing activities, security communities, conferences, or external knowledge-sharing is desirable.
- Experience working in an Agile environment is desirable.
Benefits
- Kainos emphasizes a people-first, diverse, equitable, and inclusive culture.
- Employee growth, mentoring, and career-development support are emphasized.
- Recruitment accommodations and adjustments are available through the talent acquisition team.
About Kainos
Kainos is a Belfast-headquartered, publicly listed IT services company that designs and delivers digital services and Workday solutions for public, healthcare and commercial clients. Its business includes agile software engineering, cloud and data platforms, systems integration, and a Workday implementation and testing practice (including the Smart automated testing product). Founded in 1986 and listed on the London Stock Exchange, Kainos operates across the UK, Europe and North America.