School of Medicine:

Established in 1930, Duke University School of Medicine is the youngest of the nation’s top medical schools. Ranked tenth among its peers, the School takes pride in being an inclusive community of outstanding learners, investigators, clinicians, and staff where traditional barriers are low, interdisciplinary collaboration is embraced, and great ideas accelerate translation of fundamental scientific discoveries to improve humanhealth locally and around the globe.

Comprised of 2,400 faculty physicians and researchers, the Duke University School of Medicine along with the Duke University School of Nursing and Duke University Health System create Duke Health. Duke Health is a world-class health care network. Founded in 1998 to provide efficient, responsive care, the health system offers a full network of health services and encompasses Duke University Hospital, Duke Regional Hospital, Duke Raleigh Hospital, Duke Primary Care, Private Diagnostic Clinic, Duke Home and Hospice, Duke Health and Wellness, and multiple affiliations.

Position Summary

The Technology and Data Solutions Sr. Analyst, IT - Information Security Analyst Penetration Tester supports web application and mobile application security. This role works with DCRI application owners as well as the Duke Health Information Security Office (ISO) team members to identify and mitigate security vulnerabilities in applications identified through testing. Communication with business owners, application owners, security teams, and development partners is critical in this role. The Sr. Analyst, IT - Information Security Analyst Penetration Tester also act as an application security SME for the development and security communities across Duke.

Position Responsibilities

Perform Web application and mobile application penetration testingDeliver network, service, or host-based security posture testingMeet with application teams to collect information and determine scope of testingConfigure, maintain and use scanning and testing toolsManually verify security vulnerabilities identified using automated toolsPerform manual testing to supplement results of automated scanning and testing toolsProvide status updates and resolve issues that affect testing as requiredDocument identified security vulnerabilities in a clear, concise and prioritized mannerConsult with application owners and review identified security vulnerabilities and remediation plansRetest identified issues or deployed remediation fixes to verify resolution of security vulnerabilitiesMaintain an electronic or paper trail of testing activity for audit/documentation purposesMaintain an overall inventory of applications, owners, and testing results

Provide application security consulting (SME) support as neededProvide for root cause analysis and incident management investigation with CSIRT teamProvide or attend security training as requiredStay up-to-date on emerging security vulnerabilities and attack methodsDevelop and review malicious use cases/threat modelsMaintain a broad understanding of security technologies and productsParticipate actively in improving the security culture and education throughout the organization

Education and Experience

Bachelor's degree in a related clinical or technical field, or four years of equivalent technical experience required. Two years of related experience is required.

One or more information security, industry certifications (e.g. CISSP, CISM, CISA, CEH, or equivalent) are preferred.Additional technical or management certifications (e.g. MCSE, CCNP, CCIE, or PMP) are preferred.

Preferred Qualifications

3+ years of information security experience2+ years of Application Security Testing experience2+ years of information security penetration tools experienceMust have working or expert knowledge of least three of the information security practices, standards, and systems described above.Must have working or expert knowledge of at least two of the regulatory compliance requirements and IT management frameworks described above.

In addition to those described above, the ideal candidate will have demonstrated the following characteristics through past professional and educational experiences:

-Self-starter who is able to work with minimal direction- Able to work effectively across multiple technical disciplines- Strong interpersonal skills and the ability to build relationships with colleagues, customers, vendors, and other third parties

Skills, Training and Certifications:

Certifications such as CEH, OSCP, OSWE, CISSPAdvanced Information Security technical skillsMobile and Web application security:Mobile and Web Application Pentesting Process and MethodologyWeb Application VulnerabilitiesWeb Application AttacksAndroid Application ComponentsAndroid Application AttacksiOS Application ComponentsiOS Application AttacksSecure Coding Principles

Port, protocol, and service enumeration: e.g. Wireshark, Rumble, NMap, and MasscanVulnerability scanning: e.g. Tenable Nessus, Nexpose, Acunetix WVS, NetSparkerWeb and Mobile Application testing: e.g. BurpSuite, SoapUI, ZAP, Nikto, Dirbuster, SQLMap, SQLNinja, Frida, ObjectionPenetration testing Linux distros: e.g. Backbox, Kali, MatrixAbility to manage complex issues and develop potential solutionsExcellent verbal and written communication skillsExperience working in a large enterprise environmentAbility to manage multiple and competing prioritiesAbility to take on a high level of responsibility, initiative, and accountabilityAbility to work with limited supervisionGood attention to detail and accuracy skillsKnowledge and understanding of information security industry standards and government regulationsStrong analytical skills with high attention to detail and accuracyStrong collaboration and partnering skills

Minimum Qualifications

Education

Refer to Job Description

Duke is an Affirmative Action/Equal Opportunity Employer committed to providing employment opportunity without regard to an individual's age, color, disability, gender, gender expression, gender identity, genetic information, national origin, race, religion, sex, sexual orientation, or veteran status.

Duke aspires to create a community built on collaboration, innovation, creativity, and belonging. Our collective success depends on the robust exchange of ideas—an exchange that is best when the rich diversity of our perspectives, backgrounds, and experiences flourishes. To achieve this exchange, it is essential that all members of the community feel secure and welcome, that the contributions of all individuals are respected, and that all voices are heard. All members of our community have a responsibility to uphold these values.

Essential Physical Job Functions: Certain jobs at Duke University and Duke University Health System may include essentialjob functions that require specific physical and/or mental abilities. Additional information and provision for requests for reasonable accommodation will be provided by each hiring department.