Senior Manager, Information Security (Offensive Security Testing/Red Team) McKesson is looking to hire a Senior Manager, Information Security, Offensive Security Testing/Red Team to help support McKesson's information security capabilities and compliance across Business units and Enterprise IT organizations within McKesson. As a Senior Manager, you will be a key member of our Cybersecurity team. The ideal candidate will have a deep understanding of offensive security techniques, a strong background in cybersecurity, and the ability to manage and mentor a team of security professionals. This role is critical in identifying and mitigating potential security threats to our organization.
Key Responsibilities: Lead Red Team Operations: Oversee the planning, execution, and reporting of Red Team engagements, including penetration testing, vulnerability assessments, and simulated cyber-attacks.Develop Strategies and Methodologies: Create and implement comprehensive Red Team strategies and methodologies to effectively test and improve the organization's security posture.Risk Identification and Prioritization: Collaborate with other security teams to identify, assess, and prioritize security risks and vulnerabilities across the organization.Reporting and Communication: Provide detailed reports and presentations on Red Team findings, including actionable recommendations for remediation, to both technical and non-technical stakeholders.Continuous Improvement: Stay current with the latest security threats, trends, and technologies to continuously improve Red Team tactics, techniques, and procedures.Team Management: Mentor and train team members to enhance their skills and knowledge, fostering a culture of continuous learning and professional development.Coordination with External Partners: Work with external partners and vendors to conduct specialized testing and assessments, ensuring comprehensive security evaluations.Compliance and Standards: Ensure all Red Team activities comply with industry standards, regulations, and best practices, such as MITRE ATT&CK, NIST, and ISO 27001.Incident Response Support: Assist the incident response team during security incidents by providing insights and expertise from Red Team activities.Tool Development and Maintenance: Develop, maintain, and enhance Red Team tools, scripts, and frameworks to support advanced testing and assessments.Stakeholder Engagement: Engage with various stakeholders across the organization to promote security awareness and advocate for the implementation of security best practices.Budget Management: Manage the Red Team budget, including resource allocation, tool procurement, and training expenses.Key Results: Enhanced Security Posture: Achieve a measurable improvement in the organization's security posture through effective Red Team engagements and remediation efforts.Risk Reduction: Successfully identify and mitigate critical security vulnerabilities, reducing the overall risk to the organization.Team Development: Foster a high-performing Red Team with increased skills and knowledge, demonstrated by successful engagements and professional growth.Compliance Achievement: Ensure all Red Team activities meet or exceed industry standards and regulatory requirements, contributing to the organization's compliance goals.Incident Response Efficiency: Provide valuable insights and support during security incidents, leading to faster and more effective incident resolution.Stakeholder Satisfaction: Maintain high levels of satisfaction among stakeholders through clear communication, actionable recommendations, and demonstrated improvements in security.Qualifications: Bachelor's degree (in Computer Science, Information Security, or a related field), or equivalent work experience. Advanced degree preferred.7+ years of experience in cybersecurity, with at least 3 years of experience in a Red Team or offensive security role.Strong knowledge of penetration testing tools and techniques.Proficiency in using security tools and technologies, including but not limited to Metasploit, Safebreach, Burp Suite, Nmap, Cobalt Strike, BloodHound, Empire, PurpleSharp, AttackIQ, MITRE Caldera, Wireshark, Kali Linux, Vulnerability Management Tools, Rapid7, Tenable, Qualys, OWASP security scanners.Experience in internal testing and staging of Red Team tests.Proven experience in collaborating with Blue and Purple Teams.Experience with scripting and programming languages such as Python, PowerShell, or Bash.Excellent problem-solving skills and attention to detail.Strong leadership and team management abilities.Relevant certifications such as OSCP, OSCE, CISSP, or CEH are highly desirable.Excellent communication and presentation skills.Experience with threat modeling and risk assessment methodologies.Knowledge of security frameworks such as MITRE ATT&CK, NIST, and ISO 27001.Familiarity with cloud security and DevSecOps practices.Ability to work in a fast-paced and dynamic environment.At McKesson, we care about the well-being of the patients and communities we serve, and that starts with caring for our people. That's why we have a Total Rewards package that includes comprehensive benefits to support physical, mental, and financial well-being.
#J-18808-Ljbffr