Industrial Cybersecurity Ethical Hacker

Overview:
**Industrial Cybersecurity Ethical hacker / Pen tester**

Facing growing customers' requests in securing our European Critical Infrastructures against Cyberattack, Expleo is looking to strengthen its teams to assist its customers in Air, Sea and Land Transportation.

**Role**

Your role is very diversified and exciting. You will work closely with Industrial Cybersecurity architects, Experts, Engineers and Customer Engineers and Risk Assessment teams to test and validate compliance on Security Level targeted.

In this role you will:

- ** Analyse **Architecture design, Security requirements and ensure the SUC complies to the requirements

The role is therefore twofold,
**validate** the SUC Security Level targeted and
**mitigate** residual threats.

**Profile**
- You are qualified with an IT degree or equivalent.
- You are familiar with Risk assessments and Security Level definition
- You are open to be trained / coached on various Transportation processes and landscapes.
- You are familiar with Industrial Cybersecurity standards: IEC 62443, NIST Cybersecurity framework for Critical Infrastructure.
- You have experience with OT / ICS Cybersecurity
- You are familiar with OT Network segmentation zonings & requirements
- You have strong experience in forensics analysis
- You are a threat hunter

**Technical skills**:
Those skills and certifications are a must:

- Vulnerability scanning, passive scanning,
- Certifications on Ethical hacking (CEH, SANS SEC560, OSCP,)

Those skills are a plus:

- Perform foot printing and reconnaissance using the latest foot printing techniques and tools as a critical pre-attack phase required in ethical hacking,
- Network scanning techniques and scanning countermeasures,
- Enumeration techniques and enumeration countermeasures,
- Vulnerability analysis to identify security loopholes in the target network, communication infrastructure, and end systems,
- System hacking methodology, steganography, steganalysis attacks, and covering tracks to discover system and network vulnerabilities,
- Mitre Att&CK for IT / ICS,
- Packet sniffing techniques to discover network vulnerabilities and countermeasures to defend sniffing,
- Social engineering techniques and how to identify theft attacks to audit human-level vulnerabilities and suggest social engineering countermeasures,
- DoS/DDoS attack techniques and tools to audit a target and DoS/DDoS countermeasures,
- Session hijacking techniques to discover network-level session management, authentication/authorization, cryptographic weaknesses, and countermeasures,
- Web server attacks and a comprehensive attack methodology to audit vulnerabilities in web server infrastructure, and countermeasures,
- SQL injection attack techniques, injection detection tools to detect SQL injection attempts, and countermeasures,
- Wireless encryption, wireless hacking methodology, wireless hacking tools, and Wi-Fi security tools,
- Mobile platform attack vector, android vulnerability exploitations, and mobile security guidelines and tools,
- Firewall, IDS and honeypot evasion techniques, evasion tools and techniques to audit a network perimeter for weaknesses, and countermeasures,
- Cloud computing concepts (Container technology, serverless computing), various threats/attacks, and security techniques and tools,
- Penetration testing, security audit, vulnerability assessment, and penetration testing roadmap,
- Threats to I(I)oT and OT platforms and provide guidance on how to defend I(I)oT and OT devices securely,
- Cryptography ciphers, Public Key Infrastructure (PKI), cryptography attacks, and cryptanalysis tools,
- Fluency in English is a must, knowledge of German and /or French is a plus,
- Ability to explain technical vulnerabilities and threats to non-Cybersecurity audience (Engineers, Risk assessment management team,)