IT SOC Analyst (Offensive Security)

About the role

Pak-Arab Refinery Limited (PARCO), an integrated energy conglomerate and joint venture between Pakistan and the Emirate of Abu Dhabi, is hiring an IT SOC Analyst on a contractual basis. The role covers offensive security assessments, red team exercises, penetration testing and vulnerability assessments across applications, APIs, networks, infrastructure, cloud, IoT and mobile platforms, and manages the organization's Vulnerability Assessment and Vulnerability Management program.

Key responsibilities

• Run red-team exercises, penetration tests and vulnerability assessments across applications, APIs, networks, infrastructure, cloud and other environments.
• Manage the end-to-end vulnerability management program: planning, scanning, assessment and validation, risk-based prioritization, remediation tracking, retesting and closure validation.
• Identify and validate vulnerabilities using automated tools and manual testing, and perform manual penetration testing of web apps, APIs, infrastructure, networks, cloud, IoT and mobile apps.
• Coordinate with IT, infrastructure and application teams to ensure timely remediation, and validate that vulnerabilities are closed.
• Prepare security assessment reports, risk ratings, management dashboards and remediation recommendations.
• Monitor emerging threats and attack techniques, and improve testing methodologies and security controls.
• Develop scripts and tools to automate red-teaming, vulnerability discovery and exploitation.

Required profile

• Minimum Bachelor's degree in Information Security, Computer Science, IT or a related field.
• Minimum 4 years of hands-on experience in information security, offensive security or a related field.
• Experience with red teaming, penetration testing, vulnerability assessments and an enterprise-level vulnerability management program.
• Preferred: experience in oil and gas, banking, telecommunications, technology, critical infrastructure or other highly regulated sectors.
• Relevant certifications such as OSCP or CEH required.

Required skills

• Proficiency with tools such as Burp Suite, Nmap, Nessus or Qualys, Metasploit and equivalents.
• Knowledge of OWASP Top 10, web/mobile/API and cloud security, Active Directory, Windows and Linux, authentication weaknesses and privilege escalation.
• Ability to write scripts in Bash, Python or JavaScript to automate security tasks.
• Strong technical writing, reporting, presentation and stakeholder management skills.