Penetration Tester

• Conduct penetration testing on web applications to identify vulnerabilities that could be exploited by adversaries.
• Perform white-box, gray-box, and black-box testing of enterprise applications and assets, and provide actionable reports to technical teams and stakeholders.
• Collaborate with the Information Security Office (ISO) and system owners to define the rules of engagement (ROE) for penetration testing in production environments.
• Conduct pretest analysis based on full knowledge of the target system and pretest identification of potential vulnerabilities based on pretest analysis.
• Test to determine the exploitability of identified vulnerabilities.
• Document the results of the penetration testing, including what vulnerabilities were detected and exploited and how to remediate them.
• Conduct follow-up penetration testing to confirm that vulnerabilities found in the original test were remediated successfully

The final salary and offer components are subject to additional approvals based on UC policy.

Your placement within the salary range is dependent on a number of factors including your work experience and internal equity within this position classification at UCSF. For positions that are represented by a labor union, placement within the salary range will be guided by the rules in the collective bargaining agreement.

The salary range for this position is $103,800 - $156,000 (Annual Rate).

To learn more about the benefits of working at UCSF, including total compensation, please visit: https://ucnet.universityofcalifornia.edu/compensation-and-benefits/index.html

• Bachelor's degree in related area and / or equivalent experience / training
• Minimum 3+ years experience in Penetration Testing
• Experience using IT security systems and tools. Knowledge of data encryption techniques.
• Demonstrable skills and experience that include technical expertise in network, operating system, and/or application-level security
• Knowledge of and experience with current adversarial tactics, techniques, procedures, and tools
• Familiarity with NIST SP800-53 Revision 5 and other relevant security and privacy controls
• Excellent communication skills to effectively report findings and recommendations
• Basic skill at reading and interpreting security logs
• Ability to follow department processes and procedures
• Interpersonal skills sufficient to work effectively with both technical and non-technical personnel at various levels in the organization
• Knowledge of other areas of IT, department processes and procedures
• Demonstrated skills applying security controls to computer software and hardware
• Knowledge of computer hardware, software and network security issues and approaches

• GIAC Web Application Penetration Tester (GWAPT)
• GIAC Certified Penetration Tester (GPEN)
• PenTest+
• Experience with Burp Suite and Metasploit
• Offensive Security Certified Professional (OSCP)
• Certified Expert Penetration Tester (CEPT)