Join EY to build a career defined by your unique strengths. Leverage global scale, support, and an inclusive culture to become your best self. Your distinct perspective is crucial in helping EY excel. Together, we can create an exceptional personal journey and a better working world for everyone.

This role focuses on IT Infrastructure Assessment at a senior level, contributing to diverse consulting engagements. A significant portion of your time will involve project execution in Middle East countries, requiring travel of at least 50%.

You will conduct in-depth infrastructure penetration testing and vulnerability assessments, alongside Active Directory and wireless network penetration testing. A strong grasp of encryption technologies and MiTM attacks is essential. Your role involves analyzing operational logs and event console activity to identify and resolve security-related events. You will also analyze vendor-released patches and produce comprehensive reports, clearly communicating business risks to senior management.

Key responsibilities include performing security configuration reviews for operating systems, databases, network devices, and applications. Hands-on experience with penetration testing tools and frameworks like Kali, Burp Suite, Nessus, and Qualys is vital. You will also utilize programming skills in Python, Perl, PowerShell, or C# for assessment tasks. Experience with open-source C2 frameworks, setting up phishing simulations, and conducting social engineering assessments will be leveraged.

Furthermore, you will be involved in advanced techniques such as AV evasion, obfuscation, bypassing Windows ASR/device guard, and analyzing network security controls and email gateway filtering. Experience in mentoring junior resources or managing a team is also expected.

Ideal candidates will possess a Master of Computer Applications (MCA), B.Tech, or BSc in Computer Science, Electronics and Communication, or a related field. A minimum of 3 years of core experience in IT infrastructure security assessment and penetration testing is required.

Essential skills include proficiency in network and infrastructure security assessment, penetration testing, web and mobile application penetration testing, API security, Active Directory security, vulnerability management, and wireless penetration testing. You should possess a good understanding of encryption technologies, MiTM attacks, Linux administration, TCP/IP, DNS, and network protocols. Familiarity with Active Directory administration, various authentication mechanisms, trust boundaries, the OSI model, OWASP, and Secure SDLC standards is also necessary.

Hands-on experience with security code reviews, log analysis, and security configuration reviews for various systems is crucial. Proficiency with tools like Kali, Burp Suite, Nessus, and Qualys, along with programming skills in Python, Perl, PowerShell, or C#, is expected. Experience with open-source C2 frameworks, phishing, social engineering, and advanced evasion techniques is highly beneficial. Excellent report writing skills to effectively communicate findings and business risks are a must.