Security Testing Engineer - SMBC

Role Description

The Security Testing Engineer will be responsible for executing within our Cyber Resilience Exercise program designed to increase cyber resilience capabilities and preparedness across various businesses, group companies, and functions of the bank. You will be responsible web application and network penetration testing; and issue management. In this role you will support partnerships for exercises such as cyber scenario exercising and cyber incident management.  

Reporting into the Information Security, Cyber & Operational Resilience office, the Security Testing Engineer supports the 1st Line of Defense (LOD) Information Security Group Department Americas Division’s (GPDAD) and 14 group companies managing activities related to Cyber Resilience security testing in accordance with applicable regulations, Head Office policies and industry practices for Information Security and Operational Resilience. 

Role Objectives

• Analyze IT (Information Technology) infrastructure, systems, and applications for susceptibility to various security exploits and threats. Recommend best practices to mitigate vulnerabilities and partner with IT colleagues to implement fixes. Develop and manage processes for validating and testing security policy, such as routine scans, application exploit tests, social engineering simulations, and network penetration testing. 
• Create reports based on findings, identify remediation steps, and disseminate them to stakeholders. 
• Perform in-depth analysis and testing on new systems, vendor connections, applications, and implemented vulnerability patches.  
• Manage and update testing and validation infrastructure, vendors, and practices. Maintain documentation for testing practices and validation policy. 
• Support the development of security policy and practices to provide a holistic and proactive posture against vulnerabilities and exploits.  
• Partner in and understand the impacts and plans associated with resilience of cyber threats and risks. 
• Works with business/function/entity to increase awareness of Cyber Resilience. Provides input to IT, cybersecurity, and operational resiliency risk trainings bank wide. 
• Partner with IT infrastructure and development teams to identify systems and applications for potential exploits and conduct testing and validation of code to ensure it conforms to security standards.  
• Understands changes related to regulatory, new product/initiative, processes, controls, events, issues, etc., in the IT, data management, and cybersecurity domains that may impact the operational risk profile of the bank. 
• Provides reporting to Information Security and business senior management. 
• Engage with end-user security training team to develop curriculum and focus training on the most impactful practices and policies and update according to trending threats and exploits.  
• Work with business units to understand their current processes and advise on adjustments that could be made to improve overall security. Analyze requests for exceptions where needed and suggest appropriate structuring to balance both security and operational efficiency. 

Qualifications and Skills

• Demonstrate an advanced understanding of cyber security concepts with knowledge of vulnerabilities and how they function, security and defensive posturing best practices, and threat assessment and remediation techniques.  
• Should either hold or be working towards professional certification in cyber security penetration testing.  
• Display knowledge of tools and frameworks used to conduct penetration testing, application code validation, and systems to enable real-time threat monitoring.  
• Possess knowledge of common network and data exchange protocols, hardware operating systems, and security infrastructure. 
• Show communication skills needed to effectively convey security policies and rational to business units.  
• Exhibit ability to coordinate the efforts of multiple teams and stakeholders during penetration tests, implementing vulnerability patches, and in response to security incidents. 
• 1-3 years of direct work experience within the financial services industry with focus on DAST, SAST, IAST, Network or Web Application Penetration 
• Working knowledge of technology and cyber risk management process and controls, industry practices, and frameworks (e.g., NIST (National Institute of Standards and Technology) 800-53, ISO 27001). 
• Detail oriented, with proven ability to question the status quo and apply resilience activities to enhance capabilities, as appropriate. 
• Strong organizational skills, with proven ability to successfully manage multiple, concurrent priorities. 
• Ability to communicate and work effectively in a matrixed environment and across various organizational levels, where flexibility, collaboration, and adaptability are important at all levels. 
• Foundational knowledge of banking laws and regulations. (FFIEC, NYDFS, BCBS, FCA, PRA, BoE, etc.) 
• Maintain a technical cyber threat mindset to understand underlying risks and weaknesses to properly assist in mitigating and enhancement activities. 
• Desire to continually deliver a quality and meaningful work product in a timely and efficient manner. 
• BA/BS in Computer Engineering, Computer Science, Information Systems, Cyber Security, Business Administration, or demonstrated relevant industry background and/or military experience. 
• CISSP, CCRP (Certified Cyber Resilience Professional), CEH (Certified Ethical Hacker), GIAC, or other Cyber Incident Response or Penetration Testing certifications preferred. 

Additional Requirements