Uber Security Technologist - Offensive/Pentester 

United States, West Virginia 

6913790

- - - What the Candidate Will Do ----

• Conduct white-box and grey-box offensive penetration testing against Uber’s mobile applications, front-end & back-end microservices and web services
• Conduct network infrastructure, Public Cloud (AWS and GCP), and data-layer offensive pen-testing
• Perform mobile reverse engineering and/or mobile instrumentation of mobile application products as needed to deliver mobile security assessments.
• Perform manual source code reviews and audits (manual and SCA/SAST code audits) as needed
• Be a subject matter expert and ambassador to Uber Engineering for secure coding practices, penetration testing, mobile platform security and all aspects of application and product security
• Perform any other application security or product security related activities or tasks as needed or directed
• Validate 3rd party external pen-test and crowd-sourced application security findings and work with our Appsec team to triage those across to our engineering teams

- - - - Basic Qualifications ----

• A pen-test certification such as Offensive Security Certified Professional (OSCP) or CEH, OSWE, OSCE, GPEN, GMOB, GWAPT, GXPN, eWAPT, eMAPT and/or willing to work towards ultimately obtaining one as part of your career path
• 3+ years of relevant engineering or security assessment experience
• Possess a broad knowledge of attack vectors, exploits and mitigations that work at scale or may be linked together for chained attacks
• Experience with assessing with Cloud-native services, service meshes, and Kubernetes-platform based microservices
• Experience with assessment of mobile-based applications (not just web/UI)
• Be able to apply unconventional thinking and problem-solve on the boundary of your knowledge base, learning new technologies or languages as needed to complete pen-test tasks
• Be able to think both offensively (like a hacker) and defensively (evaluating product security and design)
• Ability to create written work product, detailed technical findings documents, and pen-test reports
• Ability to create and write scripts to automate redundant activities
• Great interpersonal skills, deep technical ability, and a history of successful execution in the assessments industry. If you enjoy discussing anything from procedural linking tables in kernels to remote code execution in JVMs, then we want you on the team
• Experience with Java, Go, Python or Node.js (bonus points for more than one)
• Familiarity with industry-standard threat modeling, risk modeling and vulnerability classification.
• Experience with pre-assessment architectural and API analysis to scope and prepare white-box and grey-box assessments.
• Experience working with in-house engineering organizations, S-SDLC/CICD software lifecycle and QA processes.
• Experience with mobile reverse engineering and penetration testing.
• Experience with CLI offensive security tooling.

* Accommodations may be available based on religious and/or medical conditions, or as required by applicable law. To request an accommodation, please reach out to .