Lead Security Specialist Vulnerability Assessor (PROJ-4683)

Key duties and responsibilities

• Lead and perform forensically sound complex investigations on a wide array of assets and devices that directly relate to security infrastructure
• Assess and explain very complex threat profiles of a variety of electronic devices, as relevant to ASD
• Lead analytical processes to identify and recommend action to maintain and improve the integrity of the ICT infrastructure
• Communicate and provide advice and guidance on strategies to improve ASD's ICT security and mitigate risk of devices compromising that security
• Evaluate and assist with the application and compliance of security controls and review information systems for actual or potential security vulnerabilities
• Review and make recommendations and assess and manage associated risks of others' systems designs to ensure selection of appropriate technology, efficient use of resources and integration of multiple systems and technologies from a security perspective. 

Essential criteria

• Penetration testing: Level 5 (SFIA)

Plans and drives penetration testing within a defined area of business activity. Delivers objective insights into the existence of vulnerabilities, the effectiveness of defences and mitigating controls. Takes responsibility for the integrity of testing activities and coordinates the execution of these activities. Provides authoritative advice and guidance on all aspects of penetration testing. Identifies needs and implements new approaches for penetration testing. Contributes to security testing standards.

• Penetration Testing and conducting Simulated Attack Exercises: Level 5 (CIISEC)

Uses commercial and bespoke tools to conduct complex penetration testing without close supervision and/or leads teams undertaking complex penetration tests. Undertakes penetration exploits as part of a simulated attack exercise under direction. Appropriate and relevant certifications include CHECK Team Leader, CREST Certified Tester (Infrastructure or Web Applications) or equivalents.

• Specialist advice: Level 6 (SFIA)

Provides organisational leadership and guidelines to promote the development and exploitation of specialist knowledge in the organisation. Maintains a network of recognised experts (inside and/or outside the organisation) who can deliver expert advice in relevant areas. Provides input into professional development planning across a significant part of the organisation to further the development of appropriate expertise.

• Threat Intelligence, Assessment and Threat Modelling: Level 5 (CIISEC)

Undertakes complex threat intelligence/modelling tasks or threat assessments without supervision. Manages threat intelligence/assessment teams. Appropriate and relevant certifications include CREST Certified Threat Intelligence Manager.