Senior Security Engineer (Vulnerability Assessment)

About the role

Profectus is recruiting several experienced Senior Security Engineers (Vulnerability Assessors) to support an Australian Government agency. The role covers vulnerability assessment and security assurance, including identifying, assessing and prioritising vulnerabilities found through penetration testing and reporting findings to improve security architecture and risk awareness. It also covers threat assessment and modelling, controls testing and compliance monitoring, security audits and security incident support.

Key responsibilities

• Assess and explain the threat profiles of a range of electronic devices
• Lead analytical processes to identify and recommend actions that maintain and improve the integrity of ICT infrastructure
• Evaluate the application of security controls and assess compliance against them
• Review information systems for actual or potential security vulnerabilities
• Perform security risk and business impact analysis for complex information systems
• Investigate suspected attacks and support security incident management
• Maintain and optimise operational security processes
• Advise on implementing and managing physical, procedural and technical security across physical and digital assets
• Review others' system designs, assess associated risks and recommend technology and integration approaches
• Contribute to the development of systems design policies, standards and the selection of architecture components

Required profile

• Senior-level experience in vulnerability assessment, security assurance or security engineering
• Experience working in a team conducting compliance monitoring and security controls testing
• Experience conducting security audits as part of a team
• Experience undertaking threat intelligence, threat assessment and threat modelling with minimal supervision
• Experience interpreting penetration testing results and prioritising remediation
• Experience performing security risk assessments and business impact analysis for complex systems
• Experience delivering security work in Defence or other national security environments
• Strong written reporting skills, including presenting technical findings to non-technical stakeholders
• Australian citizenship and a current AGSVA Positive Vetting (TSPV) security clearance

Required skills

• Sound understanding of monitoring network and system activity for anomalous behaviour
• Desirable: CREST Registered Threat Intelligence Analyst or similar certification
• Desirable: offensive or assessment certifications such as OSCP, CREST CRT or GIAC (GPEN, GCIH)
• Desirable: security certifications such as CISSP, CISM or CISA
• Desirable: working knowledge of the Information Security Manual (ISM) and Protective Security Policy Framework (PSPF)
• Desirable: experience supporting security incident response and using both plan-driven and agile system design methods

The position is onsite in Canberra.