Security Analyst/Senior Security Analyst (Red Team)

Job Posting Organization:
The International Monetary Fund (IMF) is an international organization established in 1944 with the mission to promote global economic stability and growth. The IMF has a workforce of approximately 2,700 employees and operates in 190 countries. The organization plays a crucial role in providing financial assistance, policy advice, and technical assistance to its member countries, ensuring that they can achieve sustainable economic growth and reduce poverty. The IMF's Information Technology Department (ITD) is integral to its operations, focusing on leveraging technology to enhance the organization's effectiveness and efficiency.

Job Overview:
The security" style="border-bottom: 1px dotted #007bff !important;">Security Analyst/Senior Security Analyst (Red Team) position within the Information Technology Department's Information Security and Governance (ISG) division at the IMF is pivotal in enhancing the organization's cybersecurity posture. This role involves planning, executing, and managing adversarial simulation exercises that assess the security measures in place and identify potential vulnerabilities. The successful candidate will lead offensive security assessments, simulating real-world cyber threats to evaluate the organization's defenses. This position requires collaboration with various IT and cybersecurity teams to ensure that the IMF is prepared to respond effectively to cyber threats. The role is not only about identifying weaknesses but also about fostering a culture of security awareness and resilience within the organization, ensuring that all staff members are equipped to contribute to a secure operational environment.

Duties and Responsibilities:
The primary duties and responsibilities of the Security Analyst/Senior Security Analyst (Red Team) include conducting Red and Purple Team assessments to emulate cyber-attacks against the IMF’s IT environments. The analyst will support the entire Red Team lifecycle, which encompasses designing, planning, executing, and reporting on adversary simulation efforts. They will also be responsible for testing security controls, engaging in purple team exercises, and automating adversary simulations. Presenting complex findings to non-technical audiences is crucial, as the analyst must communicate the business impact of identified risks and recommend appropriate risk treatments. Collaboration with multi-disciplinary teams is essential to address exploitable security gaps discovered during exercises. The analyst will adhere to predefined rules of engagement and drive continuous innovation within the Red Team, seeking to enhance both technical and strategic aspects of the service. Additionally, the role involves developing and maintaining comprehensive documentation related to Red Team functions and tasks.

Required Qualifications:
Candidates must possess a Bachelor's degree in information security, computer science, engineering, mathematics, business, or a related field, along with a minimum of 10 years of relevant experience in an offensive security/red teaming role. Alternatively, an advanced degree in a related field with at least 4 years of experience is acceptable. Required certifications include OSCP (Offensive Security Certified Professional) or CRTO (Certified Red Team Operator) or GIAC Penetration Tester (GPEN). Preferred certifications include OSEE (Offensive Security Exploitation Expert), OSED (OffSec Exploit Developer), and GXPN (GIAC Exploit Researcher and Advanced Penetration Tester).

Educational Background:
The educational background required for this position includes a Bachelor's degree in information security, computer science, engineering, mathematics, business, or a related field. An advanced degree in one of these areas is preferred but not mandatory. The educational qualifications should provide a solid foundation in technical concepts and practices relevant to cybersecurity and offensive security roles.

Experience:
The position requires extensive experience in offensive security and red teaming, with a minimum of 10 years of relevant experience for candidates with a Bachelor's degree, or 4 years for those with an advanced degree. Experience should encompass various aspects of offensive security, including network, mobile, cloud, and social engineering. Candidates should have a proven track record of conducting security assessments and managing adversarial simulations.

Languages:
While the job posting does not specify mandatory languages, proficiency in English is essential for effective communication within the organization and with stakeholders. Additional language skills may be beneficial but are not explicitly required.

Additional Notes:
This position is a one-year contractual appointment, with the possibility of renewal for up to four years based on performance, budget availability, and ongoing business needs. The IMF promotes a non-discriminatory employment policy and welcomes requests for reasonable accommodations for disabilities during the selection process. The position is classified at levels A11 and A12 within the organization.