Position: Security
Category: Security
English level: upper
Years of experience: 2.5


Penetration testing:
Open-source intelligence (OSINT), Vulnerability scanning and exploitation, manual verification, API testing, network infrastructure penetration testing
Burp Suite, Postman, nmap,  metasploit, sqlmap, testssl, nikto, wireshark, dnsrecon, dnsmap, subbrute, amass, censys, shodan, OpenVas, theHarvester
Stress testing - slowloris testing, locust framework, slow query
OWASP Web Security Testing Guide, OWASP Application Security Verification Standard, and OWASP CheatSheet and best practices

Cloud and DevOps: 
Cloud - Google cloud - PubSub, BigQuery, AWS services, Azure - Active Directory, Defender, CloudAppSecurity, Sentinel
DevOps - docker, docker compose, swarm, kubernetes (k8s), google shell, ELK stack - elastic, logstash, kibana, graylog
Server - Nginx, apache, modsecurity
Git, bitbucket, Gitlab 
Scripting in Python, Powershell, Bash, C++

Audit:
Conducting audits in accordance with ISACA audit checklists, CIS benchmarks, software and hardware best practicies, analysis of provided documents, communications, interviews with the customer. 

Documentation:
Drawing up and structuring documentation, config plan, processes
Writing instructions and guides both for internal use and for users in Confluence.  
Statues report, final report writing.
Some experience with ISO27001 and other frameworks  

Mobile testing: 
iOS and Android testing
OWASP Mobile Security Testing Guide
Unpacking, disassembling, intercepting traffic, re-signing the application, api testing