Penetration Tester

**The Role**:
**Where you fit in**

The purpose of the IRM Function is to ensure that Shell is addressing Information Risks in an effective and efficient manner, commensurate with Shell risk appetite, and being seen as an industry leader among peers and key suppliers of security services.The Information Risk posture of Shell includes a wide variety of potential business impacts, such as HSSE impacts, production loss, financial and maintenance operations loss, loss of Most Confidential bidding data.

The IRM Function defines requirements for the assessment of Information Risks, defines the selection of mandated IT Controls, and defines and executes assessments of the design and operational effectiveness of these controls. The function organises communication campaigns to impact the behaviour of business and IT staff where it relates to Information Risks.In addition to these preventative measures, the IRM Function includes a Cyber Resilience function to understand the cyber threat landscape and the vulnerabilities to cyberattacks in IT systems and services, to detect malicious behaviour and to respond to incidents.

**What's** the role**

As part of the Information Risk Management function, the CyberDefence capability has specific focus on identifying cyber threats, discovery of IT vulnerabilities, monitoring for cyber intrusions and response to security incidentsAs part of the CyberDefence capability the Penetration testing team has the following main areas of focus:

- Support the Vulnerability Lead in planning penetration tests based on new IT developments and hypothetical threat scenarios and find appropriate budget and sponsors
- Scope the tests in more detail and find information on network address and accounts
- Execute the tests preventing Business disruption as much as possible
- Report on findings, fixing high risk vulnerabilities as soon as possible and registering other vulnerabilities for later risk priorization and remediation where required
- Operate periodic vulnerability scanning tools and services such as Nexpose, Veracode and others
- Support the Vulnerability Lead in consolidating the vulnerability scanning tools where possible
- Integrate reporting with other CyberDefence data in IRM workflow system (Collective) and data analytics solution (IRM investigation platform).

**What we need from you**
- 5-8 years of total IT experience with at least 3 years' experience in IT security and preferably experience in attack and penetration testing/ethical hacking or technical IT audits
- Has excellent analytical skills and appreciates a technical challenge
- Maintains knowledge and experience of current practice within own area of expertise and is aware of current developments within own area of expertise
- Is able to think and act like a hacker using his creativity to bypass IT defenses
- Has a solid understanding of IT networks and operating systems such as Windows and Unix/Linux.
- Has experience with analysing network traffic using tools such as tcpdump, wireshark.
- Has experience using open source scanning tools such as nmap, nessus, metasploit and/or commercial tools such as Rapid7, Quallys.
- Has experience with scripting tools and programming languages such as Perl, Python, C, C++, VBS, Java and analytical and reporting tools such as Excel, Sharepoint and preferably Splunk.
- Has relevant certifications such as, CISSP, SANS and preferably GIAC Penetration Tester (GPEN), SEC 560: Network Penetration Testing and Ethical Hacking, SEC 542: Web App Penetration Testing and Ethical Hacking, or GWAPT: GIAC Web Application Penetration
- Certifications such as OSC, OSWP, OSCE, OSEE, or OSWE
**Translated Company Description

**COMPANY DESCRIPTION**

**An innovative place to work**

There’s never been a more exciting time to work at Shell. Everyone here is helping solve one of the biggest challenges facing the world today: bringing the benefits of energy to everyone on the planet, whilst managing the risks of climate change.

Join us and you’ll add your talent and imagination to a business with the power to shape the future - whether by investing in renewables, exploring new ways to store energy or developing technology that helps the world to use energy more efficiently.

**An inclusive place to work**

To power progress together, we need to attract and develop the brightest minds and make sure every voice is heard. Here are just some of the ways we’re nurturing an inclusive environment - one where you can express your ideas, extend your skills and reach your potential.

We’re closing the gender gap - whether, that’s through action on equal pay or by enabling more women to reach senior roles in engineering and technology.

We’re striving to be a pioneer of an inclusive and diverse workplace, promoting equality for employees regardless of sexual orientation or gender identity.

**A rewarding place to work**

Combine our creative, collaborative environment and global operations with an impre