Ethical Hacking Red Team - Senior Manager

About PwCWe’re one of the world’s leading professional services organisations. From 158 countries, we help our clients, some of the most successful organisations on the globe, as well as its most dynamic entrepreneurs and thriving private businesses, to create the value they want. We help to measure, protect and enhance the things that matter most to them.Ethical HackingIn Cyber Security we deal with some of the most urgent issues facing businesses and governments today. We help organisations from all sectors operate securely in the digital world and play an integral role in helping our clients ensure they’re protected. PwC’s UK based ethical hacking team is the global Centre of Excellence for Ethical Hacking at PwC. Our vision is to become the premier global Ethical Hacking team - the first point of call for FTSE 100 and Fortune 500 clients looking for a true partner. As a senior manager in this high performing team, you will have responsibility for assisting clients in testing the effectiveness of security controls in both the technology and human process spaces. No technology based solution can completely prevent human error - we work closely with our clients to become their trusted advisors offering far more than commodity penetration testing. Using blended teams of experts from across our Threat Intelligence, Incident Response and Ethical Hacking teams, we provide customised solutions that meet the business objectives of our clients. PwC UK provides real world attack simulation services to clients across the globe from our base in the UK and as a senior manager in this team a significant part of the role will involve overseeing and delivering red teams. The team is made up of specialists from many backgrounds - from red teaming, software development, computer networking, systems administration, hardware testing, reverse engineering, as well as those that have spent their entire careers working in the cyber security industry. Our strength lies in our continuing expansion of our capabilities, our flexibility, our curiosity and our investment in training and research to ensure we develop our people to become world class experts in their chosen specialisms.

In Cyber Security we deal with some of the most urgent issues facing businesses and governments today. We help organisations from all sectors operate securely in the digital world and play an integral role in helping our clients ensure they’re protected.

PwC’s UK based ethical hacking team is the global Centre of Excellence for Ethical Hacking at PwC. Our vision is to become the premier global Ethical Hacking team - the first point of call for FTSE 100 and Fortune 500 clients looking for a true partner. As a senior manager in this high performing team, you will have responsibility for assisting clients in testing the effectiveness of security controls in both the technology and human process spaces. No technology-based solution can completely prevent human error - we work closely with our clients to become their trusted advisors offering far more than commodity penetration testing.

Using blended teams of experts from across our Threat Intelligence, Incident Response and Ethical Hacking teams, we provide customised solutions that meet the business objectives of our clients. PwC UK provides real world attack simulation services to clients across the globe from our base in the UK and as a senior manager in this team a significant part of the role will involve scoping, delivering and overseeing red teams engagements.

The team is made up of specialists from many backgrounds - from red teaming, software development, computer networking, systems administration, hardware testing, reverse engineering, as well as those that have spent their entire careers working in the cyber security industry. Our strength lies in our continuing expansion of our capabilities, our flexibility, our curiosity and our investment in training and research to ensure we develop our people to become world class experts in their chosen specialisms.

The Role

As a Red Team Senior Manager you will be working in line with CREST and other relevant industry standards in order to deliver attack simulation services at the highest levels into our clients .Our clients are some of the largest global organisations and come from all sectors including a significant proportion from our traditional background in the financial services sector. All share a key objective

and want to understand the risks they face from real world threats so we package up individual work programs to meet their needs. We increasingly see questions coming from company boards and risk committees asking the questions that only an effective adversary simulation exercise can answer. The candidates we are looking for are ideally a current or previously qualified CREST Certified Simulated Attack Specialist (CCSAS) or Certified Simulated Attack Manager (CCSAM). Candidates should have experience scoping and delivering high level red teams but also with good experience testing network infrastructure and applications as these skills are essential when performing lateral movement and gaining access to target platforms. Much of our work involves targets with capable monitoring and incident response teams and modern EDR platforms so experience bypassing common products and demonstrating strong operational security awareness is important. Senior managers should be able to work directly with clients and build strong credible relationships amongst peers. Public speaking at conferences is supported should a candidate wish to pursue such

opportunities and there is a desire to feedback research to the community through thought leadership.

PwC provides staff with extensive training and revision time to facilitate professional development and progress through industry exams. Our people are, where possible, encouraged to undertake a UK government security clearance as part of this role.

As an Ethical Hacking Senior Manager you will have the opportunity to:

● Deliver and manage complex client engagements requiring the use of offensive security tools and techniques to to identify weaknesses in client IT environments by legally breaking into computer systems, websites, mobile applications and wireless platforms as part of real world simulated attack scenarios;

● Research a variety of topics including: advanced evasion techniques for enhancing our red team capabilities and other novel techniques and capabilities;

● Contribute to the creation of new private and public tooling to enhance deliver capabilities;

● Work with a world leading Threat Intelligence team to deliver full package solutions to clients looking to answer both the “who” and the “how” questions for possible attacks;

● Work closely with a dedicated development team to research and weaponise new vulnerabilities and techniques for bypassing endpoint security solutions;

● Manage and mentor junior staff and managers through sharing of professional and technical skills and experience;

● Maintain and develop relationships with a portfolio of iconic clients, understanding their needs, producing proposals to address them and providing risk based recommendations on security matters;

● Work with clients to review and enhance the security of key platforms such as Azure AD,

Office 365 and a variety of supporting cloud platforms including IaaS and SaaS;

● Write risk based reports and attend customer delivery meetings;

● Act as a technical SME for collaborative projects with other business teams such as Incident

Response, Threat Intelligence, Crisis Response and Cyber Security Advisory;

● Develop new products and services to ensure we remain at the forefront of the industry;

● You can also expect to perform some of the following business development activities

○ Meet with clients to understand their needs and help produce proposals

○ Mentor and help upskill junior colleagues in the team

○ Develop toolkits and methodologies to enhance our sales and delivery capability

○ Contribute to research, public blogs and whitepapers to improve our public profile

○ Attend and speak at conferences within the Information Security community

○ Collaborate to develop new and innovative security services for our clients

○ Develop new and innovative security services for our clients

○ Work with our outreach teams to support schools, colleges and universities in

showing the next generation the opportunities available in the cyber industry.

Skills and experience

● Significant practical experience delivering red teaming services to customers;

● Expert user in a variety of common operating systems such as Windows, Linux and MacOS;

● Experienced in using a wide variety of command and control frameworks such as Cobalt, Strike and Mythic

● Experience of working covertly where evading a proactive blue team is a priority

● Good working knowledge of Azure AD, AWS, Office 365 and common cloud hosting platforms.

● Strong Active Directory knowledge and familiarity with offensive enumeration techniques, including public tooling such as BloodHound, and PingCastle.

● Practical experience of building and automating red team infrastructure

● Extensive knowledge of security testing requirements and techniques, demonstrated by Cyber Security Industry qualifications such as CRTO, OSCE/OSCE3 and CREST* CCSAS and CCSAM.

● While not prerequisites, the following will be advantageous:

○ Knowledge of endpoint security technologies (e.g. Microsoft ATP)

○ Good scripting and automation skills

○ Degree in computer science, cyber or STEM subjects or demonstrate professional development, industry qualification and practical experience;

○ Experience of performing red team reviews against very large-scale, complex

environments.

○ Background in software development with a low level language (ASM/C/C++)

○ Working knowledge of Win32 APIs and experience programming and scripting

○ Experience in complex OT environments and understanding of their unique risks

● Excellent business communication skills, including writing proposals, initiating client engagements, leading workshops, writing reports, and delivering presentations to clients;

Who we’re looking for

We are looking for individuals that thrive in a high tech, entrepreneurial environment such that they are comfortable working independently with little supervision and have a strong desire to learn and a willingness to share knowledge. We are looking for individuals who thrive in a team environment and who understand that we are far more than the sum of our parts when working collaboratively both with colleagues and also with clients and third parties. People that succeed in our business have a passion for cyber security, are naturally inquisitive and get a buzz from solving complex problems. Furthermore, they have a good attention to detail allied with exceptional analytical and technical aptitude. Most of all, they are or have a desire to be excellent communicators as we are in a business founded on strong relationships.

About PwC

We’re one of the world’s leading professional services organisations. From 158 countries, we help our clients, some of the most successful organisations on the globe, as well as its most dynamic entrepreneurs and thriving private businesses, to create the value they want. We help to measure, protect and enhance the things that matter most to them.

The skills we look for in future employees

All our people need to demonstrate the skills and behaviours that support us in delivering our business strategy. This is important to the work we do for our business, and our clients. These skills and behaviours make up our global leadership framework, ‘The PwC Professional’ and are made up of five core attributes; whole leadership, technical capabilities, business acumen, global acumen and relationships.

Learn more here www.pwc.co.uk/ethicalhacking

Learn more about our packages here https://www.pwc.co.uk/careers/about-us/reward.html

*PwC pays a financial incentive for those qualified with these and other certifications

Risk
Risk is all around us and in our complex world, is changing all the time. Our teams bring people from diverse backgrounds together, using their skills and cutting-edge technology, to help solve complex problems. We are pioneers in a world of changing risk and our market leading services build resilient organisations. Join us and together, we can support our clients to rethink risk.

Not the role for you?
Did you know PwC offers flexible career arrangements and contract work? Learn more.

The skills we look for
The PwC Professional is our global framework for defining and encouraging leadership at all levels. Learn more.

The Deal
‘The Deal’, our firmwide Employee Value Proposition’ empowers our people to be the best they can be. Learn more.

Our commitment to you
We’re committed to building a culture that empowers all of our people to thrive and feel a sense of belonging at PwC. Learn more.

Application support
If you’re a person with a disability, if you’re neurodivergent, or if you have a condition that you believe may affect your performance during our selection process, we’ll be happy to make reasonable adjustments to our processes for you. Learn more.