Security Principal Pentester - OASE

at Oracle in Springfield, Illinois, United States

Job Description

Job Description

Who are we?

Oracle Analytics organization plays a meaningful role in delivering and supporting best-of-breed cloud solutions to Oracle customers.

The Service Excellence team at Oracle Analytics Cloud (OAC) is on the verge of redefining the development paradigms at software giant. With the world moving towards the Cloud, Oracle is at the forefront with tremendous portfolio of Cloud offerings.

However, this transformation happens not just at the product level, but also in the process of developing, deploying, and operating these products in the Cloud. Using a combination of ground breaking technologies, continuous process improvements and innovative business transformation methodologies, a small group of us are inventing on the Service Excellence philosophy.

Position Overview:

A unique opportunity to join a rapidly growing outstanding organization, working in the Oracle Analytics Security team tasked with enabling Oracle’s large-scale business to seamlessly operate in multiple Cloud Environments. This mission is achieved by helping the Oracle Analytics lines of business scale up and out and meet regulatory demands in global markets.

To help combat emerging threats, Oracle employs an innovative Assume Breach strategy and leverages highly niche groups of security experts to strengthen threat detection, response and defense for its enterprise cloud services.

Responsibilities displayed in the job posting

Role & Responsibilities

We are looking for hands-on Security Engineer with hacker (Red, Black-box) and cloud pen-testing expertise with passion in identifying and exploiting complex Security problems in distributed, multi-tenant services and infrastructure to help keep our services secure.

Oracle Cloud Infrastructure (OCI) provides Infrastructure-as-a-Service. We operate distributed systems at a high scale, worldwide. These are the foundation of our cloud environments. Our customers run their businesses on our cloud, and our mission is to provide them with an outstanding and ever-expanding set of cloud-based services from Oracle Analytics.

Within Oracle Analytics Service Excellence org, our Security team conducts penetration testing, hacking, vulnerability discovery / security engineering / Application Security, security reviews, research, and serves as red team. We ensure the security of software and hardware that run our cloud services strive to continuously improve our security stance.

These are exciting times in our space. We are growing fast, still at an early stage and working on ambitious new initiatives. A security-focused engineer at any level can have significant technical and business impact. Come shape the future of one of the largest cloud services on earth with us.

Qualifications:

Some of our people have qualifications like the ones listed below. Our ideal candidate is passionate about security and fostering their knowledge every day. You enjoy diving into complex source code, audits to reveal subtle security vulnerabilities, writing new tools such as fuzzers in languages such as Python, Go or Java, tearing apart an undocumented file format or network protocol and coming up with novel techniques to solve outstanding and exciting security problems. We hope you like working at scale as much as we do much as we do, because Oracle has no shortage of it. Come join us today!

General Qualifications

The candidate must have knowledge and experience with:

+ Oracle Cloud Infrastructure (OCI) and/or AWS, Azure, or GCP compute, storage, and network operational experience.

+ Methodical approaches to fixing and solving complex technical problems

+ Issue tracking and teamwork (Jira and Confluence).

+ Producing documentation in support of developed work (KBs, run books, help guides).

+ Linux/Unix system administration including system level knowledge of Linux on OCI Gen 2, creating and completing scripts.

+ Networking and TCP/IP fundamentals.

+ Applying agile methodologies.

+ Working with remote, global teams as well as individuals.

+ Ability to effectively assess and communicate risks and appropriate levels of urgency to management and engineering staff as we as team environment

+ Working independently and in a self-directed manner.

Preferred Qualifications

+ proven experience in Security engineering / application / penetration (Red/Black-box) / vulnerabilities

+ Strong application/product/software security background

+ Vulnerability discovery across Cloud services

+ Extensive research or experience with multiple classes of security bugs

+ Emergent threat testing

+ Understand internet networking services, such as DNS, HTTP, etc.

+ Programming and scripting languages (Python, Java, bash are our preferred)

+ Using Ci/CD scripting tools such as Ansible, Puppet, or Chef.

+ Containers and orchestration (Docker, Kubernetes).

+ Oracle Database, MySQL or other RDBMS.

+ Used Kali Linux, BurpSuite, Postman, Nmap.Nessus, Wireshark

Top 3 abilities / technologies in the ideal candidate:

+ Demonstrated competence in managing large scale cloud Security projects

+ Security lifecycle, Security Pen-testing, hacking

+ Strong sense of ownership, accountability and drive

Career Level – IC4

Responsibilities

Responsible for advanced planning, design and build of security systems, applications, environments and architectures; oversees the implementation of security systems, applications, environments and architectures and ensures compliance with information security standards and corporate security policies and procedures.

Provides technical advice and direction to support the design and development of secure architectures.

May participate in an incident management team, bringing advanced-level skills to respond to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may act as Incident Commander of serious incidents. Develops new methods, and playbooks, as well as sophisticated scripts, applications, and tools, and trains others in their use.

May participate in an incident management team, responding to security events in line with Oracle incident response playbooks. Investigates purported intrusions and breaches, and oversees root cause analysis. Coordinates incidents with other business units and may act as incident commander of serious incidents. Participates in developing new methods, playbooks throughout Oracle.

Evaluates existing and proposed technical architectures for security risk, provides technical advice to support the design and development of secure architectures and recommends security controls to mitigate those risks. Evaluations of internal security architecture may include design assessment, risk assessment, and threat modeling.

Brings advanced-level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required, and where computer programming/scripting knowledge is required.

Work with Senior management to develop and implement a multi-year security roadmap

Focus on operational and strategic level tasks, and provide counsel and guidance to the junior level security operations engineers in the department.

Disclaimer:

Certain US customer or client-facing roles may be required to comply with applicable requirements, such as immunization and occupational health mandates.

Range and benefit information provided in this posting are specific to the stated locations only

US: Hiring Range: from $109,100 to $223,500 per annum. May be eligible for bonus and equity.

Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, mar