Do you want your voice heard and your actions to count?
Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world’s leading financial groups. Across the globe, we’re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.
With a vision to be the world’s most trusted financial group, it’s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.
Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.
The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.Job Summary
Being part of the red team provides you with the opportunity to work on the cutting edge of cybersecurity and help drive the improvement of detection capabilities as well as strengthening of defenses to improve our overall security posture. The role also offers you with the opportunity to lead and mentor junior team members and provide guidance on complex projects.
Major Responsibilities
Developing guidelines for the usage, control, maintenance and audit-readiness of information and computer resources that are used in the distributed processing environment.
Analyzing and addressing customer security requirements for all business applications existing on a distributed platform.
Assisting in the evaluation, selection, and installation of security software products for distributed platforms.
Identifying distributed systems security issues as they arise and coordinating with the security architect to ensure that issues are addressed and resolved in a timely basis.
Conduct tactical assessments that require expertise in social engineering, application security (web and mobile), physical methods, lateral movement, threat analysis, internal and external network architecture and a wide array of products
Document and formally report testing initiatives, along with remediation recommendations and validation
Maintain tools and scripts used in penetration-testing and red team processes
Conduct research into real-world threat actor tactics, techniques, and procedures (TTPs) and apply that knowledge to Red Team Exercises
Assess new technologies, software applications, and devices for potential avenues of exploitation
Develop exploits based on identified vulnerabilities
Develop scripts, tools, or methodologies to enhance Red Team processes
Work with teammates to consistently learn and share advanced skills and foster team excellence
Qualification
Bachelor's Degree in Computer Science or related fields; applicable specialized training; or equivalent work experience - equally preferable
Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), OSCP, OSCE, GWAPT, or other security certifications desired
Understanding of one or more compliance frameworks: NIST, FFIEC, GLBA, SOX, PCI, etc.
5-7 year of experience conducting penetration-testing/red team engagements
Experience in planning and executing advanced attacks that evade network and endpoint security controls to demonstrate the potential adverse impact caused by a threat actor
Experience with implementing red team assessment methods, tools, and techniques
Experience identifying and exploiting common web-application vulnerabilities, such as: SQL Injection, DOM Manipulation, Authorization System Bypass, Design Logic issues, bounds checking, role & access validation, and filter evasion.
Experience handcrafting/dissecting HTTP conversations
Experience in developing, extending, or modifying exploits and offensive security tools (shellcode, implants, reflective loaders, etc.), as well as operational experience exploitation, lateral movement, and persistence on Windows and Linux systems, bypassing preventative and detective endpoint and network security controls, C2 frameworks (Cobalt Strike and Metasploit), using common offensive security tools (nmap, CrackMapExec, Impacket, Responder, etc.)
The typical base pay range for this role is between $108K - $150K depending on job-related knowledge, skills, experience and location. This role may also be eligible for certain discretionary performance-based bonus and/or incentive compensation. Additionally, our Total Rewards program provides colleagues with a competitive benefits package (in accordance with the eligibility requirements and respective terms of each) that includes comprehensive health and wellness benefits, retirement plans, educational assistance and training programs, income replacement for qualified employees with disabilities, paid maternity and parental bonding leave, and paid vacation, sick days, and holidays. For more information on our Total Rewards package, please click the link below.