IT SOC Analyst

IT SOC Analyst (Contractual) Pak-Arab Refinery Limited (PARCO) Pak-Arab Refinery Limited (PARCO), an integrated energy conglomerate, is a Joint Venture between Pakistan and Emirate of Abu Dhabi. PARCO owns and operates Pakistan’s most modern refinery, over 2,000 kms of pipeline network, strategic storage facilities and marketing operations. The Company has Joint Ventures with renowned international companies and is continually following an aggressive growth strategy with planned expansions, acquisitions, and penetration into new markets. PARCO is seeking applications for the position of IT SOC Analyst (Contractual). About the Role The role is responsible for conducting offensive security assessments, red team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud environments, IoT devices, mobile applications, and other technology platforms. The position will also manage and continuously improve the organization’s Vulnerability Assessment/Vulnerability Management Program, ensuring effective identification, risk prioritization, remediation, validation, and closure of security vulnerabilities. Qualification and Competencies Minimum Bachelor’s degree in Information Security, Computer Science, IT, or a related field. Strong analytical, investigative, and problem-solving capabilities. Ability to work effectively with cross-functional technology and business teams. Strong technical report-writing and communication skills. Ability to communicate and present security findings to both technical teams and management stakeholders. Strong stakeholder management and coordination capabilities. Relevant certifications such as OSCP, CEH, or equivalent required. Experience Minimum 4 years of relevant hands-on experience in information security, offensive security, or a related field. Hands-on experience in red teaming, penetration testing, vulnerability assessments, and other offensive security activities. Experience managing or contributing to an enterprise-level Vulnerability Assessment or Vulnerability Management Program—from vulnerability identification and validation through remediation and closure. Experience in risk-based vulnerability prioritization, remediation tracking, validation, and management reporting. Experience conducting security testing of Web applications and services, APIs, Networks and infrastructure, Cloud environments, Mobile applications, IoT devices, and other technology environments. Experience working with cross-functional technology and business teams to address identified security risks. Experience preparing security assessment reports and presenting findings to technical and management stakeholders. Candidates with experience in the following industries will be preferred: Oil and Gas Banking and Financial Services Telecommunications Technology and IT Services Critical Infrastructure Other highly regulated or security-sensitive industries Job Responsibilities Conduct red-team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other technology environments. Manage the end-to-end Vulnerability Assessment and Vulnerability Management Program, including, Planning and scheduling, Vulnerability scanning, Assessment and validation, Risk-based prioritization, Remediation tracking and Retesting and closure validation. Identify, validate, and assess vulnerabilities and potential attack paths using automated tools and manual testing techniques. Perform manual penetration testing of websites, services, applications, APIs, infrastructure, networks, cloud environments, IoT devices, and mobile applications to discover and exploit vulnerabilities. Coordinate with IT, infrastructure, application, and other relevant teams to ensure timely remediation of identified vulnerabilities. Validate completed remediation actions and ensure vulnerabilities are closed in accordance with defined risk and compliance requirements. Prepare technical security assessment reports, risk ratings, management dashboards, and practical remediation recommendations. Monitor emerging vulnerabilities, exploits, threats, and attack techniques and assess their potential impact on the organization. Continuously improve security-testing methodologies, vulnerability-management processes, offensive-security capabilities, and related security controls. Develop scripts, tools, and methodologies to improve and automate red-teaming, vulnerability discovery, validation, and exploitation activities. Specific Skills Strong hands-on skills in red teaming, penetration testing, vulnerability assessment, and offensive security. Ability to manage an enterprise-level Vulnerability Assessment and Vulnerability Management Program. Proficiency with security-testing tools such as Burp Suite, Nmap, Nessus or Qualys, Metasploit or any other equivalent vulnerability assessment and penetration-testing tools. Strong knowledge of: OWASP Top 10 Web & mobile application and API security Network and infrastructure security Cloud security testing Active Directory security Windows and Linux environments Authentication and authorization weaknesses Privilege-escalation techniques Common exploitation techniques and attack paths Ability to distinguish false positives from genuine vulnerabilities and manually validate security findings. Good understanding of risk-based vulnerability prioritization, remediation management, and closure requirements. Ability to develop scripts and tools for automating vulnerability discovery or exploitation using Bash, Python, JavaScript, or similar languages. Strong technical documentation, report-writing, communication, presentation, and stakeholder-management skills. Location: Corporate Headquarters – Karachi PARCO is an equal opportunity employer. We value diversity and encourage candidates from all backgrounds to apply. Our commitment to a conducive work environment is designed to attract and nurture top talent.