In order to address the most critical needs of our clients, RSM US LLP has established the Security and Privacy Services group, comprised of more than 100 professionals dedicated exclusively to serving the cyber security needs of our clients. This group includes experienced consultants located throughout the country dedicated to helping clients with preventing, detecting, and responding to security threats that may affect their critical systems and data. We serve a diverse client base within a variety of industries, and we are relied upon to provide expertise within areas of security testing, architecture, governance, compliance, and digital forensics.
We are seeking individuals skilled at performing vulnerability assessments, penetration testing, secure code reviews, and secure architecture reviews of web applications and their related infrastructure.
Responsibilities will be based on background but will typically include:
Perform analysis and testing to verify the strengths and weaknesses of Web Applications and Web Services (SML, SOAP, WSDL, UDDI, etc.) utilizing commercial and open source security testing tools
Perform Internet penetration testing (blackbox/greybox /whitebox testing) and code reviews (manual/automated) of web applications and related infrastructure
Perform automated and manual reviews of the underlying code of web applications in regards to common security weaknesses
Assist with the development of remediation recommendations for identified findings
Identify and clearly articulate (written and verbal) findings to senior management and clients. Help identify improvement opportunities for assigned clients Supervise and provide engagement management for other staff working on assigned engagements
This position is for individuals with 1-6 years of experience within the cyber security space, with a preference for prior consulting or professional services backgrounds. Other candidates may be considered based on experience and skill sets.
Ability to travel as needed
Must possess a high degree of integrity and confidentiality, as well as the ability to adhere to both company policies and best practices
Strong verbal and written abilities
Strong multitasking and project management skills
Bachelor’s degree in computer science or related field from an accredited college/university
Technical background in web application development, architecture, assessment or related fields
Experience with testing and development frameworks such as the Open Web Application Security Project (OWASP), Open Source Security Testing Methodology Manual (OSSTMM), the Penetration Testing Execution Standard (PTES)Operating System Configuration and Security experience (Windows, HP-UX, Linux, Solaris, AIX, etc.)
Configuration and Security experience with Web Servers and Web Applications (Apache HTTP/Tomcat, Microsoft IIS, Sun One, Oracle iPlanet, IBM WebSphere, etc.)
Database Configuration and Security experience (MySQL, Microsoft SQL, IBM DB2, Sybase, Oracle, etc.)Web Service experience (XML, SOAP, WSDL, UDDI, etc.)
Experience with discovering and demonstrating web application vulnerabilities such as Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Injection Flaws, Remote file inclusion (RFI) and SQL InjectionCommercial Application Security tools experience (AppScan, WebInspect, Acunetix, etc.)
Web Proxy tools experience (Achilles, Webscarab, Burp, Spike, Paros, etc.)
One or more of the following technical certifications: Sun Certified Java Developer® (SCJD®); Microsoft Certified Solution Developer® (MCSD®) for .NET; Certified Ethical Hacker (CEH); GIAC Certified Penetration Tester (GPEN); Offensive Security Certified Professional (OSCP); GIAC Web Application Security (GWAS);or equivalent development or testing certification (ECSA, CEPT, CPTE, CPTS, etc.)
In addition, one or more of the following governance certifications is preferred: Certified Information Systems Security Professionals® (CISSP®); Certified Information Systems Auditor® (CISA®); Certified Information Security Manager® (CISM®)