IT SOC Analyst

Pak-Arab Refinery Limited (PARCO), a leading integrated energy conglomerate and a joint venture between Pakistan and the Emirate of Abu Dhabi, is seeking a skilled IT SOC Analyst on a contractual basis. PARCO operates Pakistan’s most modern refinery, an extensive pipeline network, strategic storage facilities, and marketing operations. The IT SOC Analyst will play a critical role in enhancing the organization's cybersecurity posture by conducting offensive security assessments, red team exercises, penetration testing, and vulnerability management across diverse technology platforms including applications, APIs, networks, cloud environments, IoT devices, and mobile applications. This role also involves managing and continuously improving the Vulnerability Assessment and Vulnerability Management Program to ensure timely identification, prioritization, remediation, and closure of security vulnerabilities.

Key Responsibilities
- Conduct red team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other technology environments.
- Manage the end-to-end Vulnerability Assessment and Vulnerability Management Program, including planning, scheduling, scanning, assessment, validation, risk-based prioritization, remediation tracking, retesting, and closure validation.
- Identify, validate, and assess vulnerabilities and potential attack paths using both automated tools and manual testing techniques.
- Perform manual penetration testing on websites, services, applications, APIs, infrastructure, networks, cloud environments, IoT devices, and mobile applications to discover and exploit vulnerabilities.
- Collaborate with IT, infrastructure, application, and other relevant teams to ensure timely remediation of identified vulnerabilities.
- Validate remediation actions and ensure vulnerabilities are closed in line with risk and compliance requirements.
- Prepare detailed technical security assessment reports, risk ratings, management dashboards, and actionable remediation recommendations.
- Monitor emerging vulnerabilities, exploits, threats, and attack techniques, assessing their potential impact on the organization.
- Continuously enhance security-testing methodologies, vulnerability management processes, offensive security capabilities, and related controls.
- Develop scripts, tools, and methodologies to automate and improve red teaming, vulnerability discovery, validation, and exploitation activities.

Required Qualifications
- Bachelor’s degree in Information Security, Computer Science, IT, or a related field.
- Minimum of 4 years of hands-on experience in information security, offensive security, or related disciplines.
- Proven expertise in red teaming, penetration testing, vulnerability assessments, and offensive security activities.
- Experience managing or contributing to enterprise-level Vulnerability Assessment or Vulnerability Management Programs, including risk-based prioritization and remediation tracking.
- Strong knowledge of security testing across web applications, APIs, networks, cloud environments, mobile applications, and IoT devices.
- Relevant certifications such as OSCP, CEH, or equivalent are mandatory.
- Proficiency with security testing tools like Burp Suite, Nmap, Nessus or Qualys, Metasploit, or similar.
- Deep understanding of OWASP Top 10, web/mobile application security, network and infrastructure security, cloud security testing, Active Directory security, and Windows/Linux environments.
- Ability to distinguish false positives from genuine vulnerabilities and manually validate findings.
- Skilled in scripting and automation using Bash, Python, JavaScript, or similar languages.
- Excellent technical documentation, report writing, communication, presentation, and stakeholder management skills.
- Strong analytical, investigative, and problem-solving abilities with the capacity to work effectively across cross-functional teams.

Preferred Qualifications and Benefits
- Experience in highly regulated or security-sensitive industries such as Oil and Gas, Banking and Financial Services, Telecommunications, Technology and IT Services, or Critical Infrastructure is preferred.
- PARCO is committed to diversity and equal opportunity, encouraging candidates from all backgrounds to apply. The company fosters a supportive and inclusive work environment designed to attract and nurture top talent.

Location: Corporate Headquarters – Karachi

This role offers an excellent opportunity to contribute to the cybersecurity resilience of a major energy conglomerate while working in a dynamic and growth-oriented environment.