ITSGS0004 – SENIOR CYBER SECURITY SPECIALIST: RED

To support the execution of cyber security management with a primary focus on red teaming, purple teaming and DevSecOps. To build and mature the ability to test, validate and mature controls within the context of red and blue teaming. This includes responsibility for penetration testing and maturing DevSecOps and application security. This is a technical role requiring practical experience in penetration testing, red teaming, SDLC security and DevOps. This is a permanent position based at the Head Office in Cape Town. *• Responsible for Red Teaming* o Work with the rest of the security operations team to proactively identify vulnerabilities and validate controls across the Woolworths environment. o Support the team in responding to security incidents. o Work with, and coordinate, external providers where and when relevant. o Build and mature the red and purple teaming maturity, leveraging technology and automation with the goal of continual control validation. *• Responsible for improving application security* o Integrate security practices into the SDLC and DevSecOps under the guiding principles of ‘shift left’ and ‘security by default’. o Provide expert guidance on, and where relevant maintain and enhance the toolsets required for mature application security covering pen testing, secure coding, source code analysis and vulnerability management. o Investigate new approaches, technologies, and automation to mature AppSec. o Provide AppSec training. *• Responsible for penetration testing* o Define and manage a risk-based methodology for application and infrastructure penetration testing. o Coordinate application and infrastructure penetration testing according to the methodology and where relevant, in line with compliance requirements (e.g., PCI). o Help drive and validate remediation of findings. o Consult with application development teams during projects and initiatives. o Provide AppSec reporting for operational security dashboards. o Provide application security guidance via documentation, standards, and collaboration. • Grade 12 and relevant degree/diploma (3 years) • 7 years relevant experience in cyber security, up to 10 years in IT  • Hands on practical experience in application security and penetration testing • Experience in DevOps / DevSecOps and the ability to integrate security into the CI/CD processes *Additional Criteria* • Software development experience • Relevant qualifications and certifications such as OSCP, OSWE, SANS and CREST • Practical experience with the MITRE ATT&CK framework is advantageous • Ability to script and automate processes • May be required to assist outside of working hours • Knowledge of Woolworths IT and cyber security landscape, including systemic understanding of key business linkages and dependencies  • Is aware of and responsive to internal and external events and influences on the technical landscape  • Ability to research technology-related concepts, trends and best practices, and apply findings •