IT SOC Analyst

Pak-Arab Refinery Limited (PARCO), a leading integrated energy conglomerate and a joint venture between Pakistan and the Emirate of Abu Dhabi, is seeking a skilled IT SOC Analyst on a contractual basis. PARCO operates Pakistan’s most advanced refinery, an extensive pipeline network, strategic storage facilities, and marketing operations. The company is focused on growth through expansions, acquisitions, and entering new markets. The IT SOC Analyst will play a critical role in conducting offensive security assessments, red team exercises, penetration testing, and vulnerability management across diverse technology platforms including applications, APIs, networks, cloud environments, IoT devices, and mobile applications.

Key Responsibilities
- Conduct red team exercises, penetration testing, vulnerability assessments, and security testing across applications, APIs, networks, infrastructure, cloud, and other technology environments.
- Manage the end-to-end Vulnerability Assessment and Vulnerability Management Program, including planning, scheduling, scanning, assessment, validation, risk-based prioritization, remediation tracking, retesting, and closure.
- Identify, validate, and assess vulnerabilities and potential attack paths using both automated tools and manual testing techniques.
- Perform manual penetration testing on websites, services, applications, APIs, infrastructure, networks, cloud environments, IoT devices, and mobile applications to discover and exploit vulnerabilities.
- Coordinate with IT, infrastructure, application, and other relevant teams to ensure timely remediation of identified vulnerabilities.
- Validate remediation actions and ensure vulnerabilities are closed in compliance with risk and regulatory requirements.
- Prepare detailed technical security assessment reports, risk ratings, management dashboards, and provide actionable remediation recommendations.
- Monitor emerging vulnerabilities, exploits, threats, and attack techniques to assess their potential impact on the organization.
- Continuously enhance security-testing methodologies, vulnerability management processes, offensive security capabilities, and related controls.
- Develop scripts, tools, and methodologies to automate and improve red teaming, vulnerability discovery, validation, and exploitation activities.

Required Qualifications
- Bachelor’s degree in Information Security, Computer Science, IT, or a related field.
- Minimum 4 years of hands-on experience in information security, offensive security, red teaming, penetration testing, and vulnerability assessments.
- Proven experience managing or contributing to enterprise-level Vulnerability Assessment and Vulnerability Management Programs.
- Strong analytical, investigative, and problem-solving skills with the ability to work effectively across cross-functional technology and business teams.
- Excellent technical report-writing, communication, and presentation skills to convey security findings to both technical and management stakeholders.
- Relevant certifications such as OSCP, CEH, or equivalent are mandatory.
- Proficiency with security-testing tools including Burp Suite, Nmap, Nessus or Qualys, Metasploit, or similar tools.
- In-depth knowledge of OWASP Top 10, web and mobile application security, API security, network and infrastructure security, cloud security, Active Directory, Windows and Linux environments, authentication and authorization weaknesses, privilege escalation, and common exploitation techniques.
- Ability to distinguish false positives from genuine vulnerabilities and manually validate security findings.
- Strong understanding of risk-based vulnerability prioritization, remediation management, and closure processes.
- Capability to develop automation scripts and tools using Bash, Python, JavaScript, or similar languages.

Preferred Qualifications and Benefits
- Experience in highly regulated or security-sensitive industries such as Oil and Gas, Banking and Financial Services, Telecommunications, Technology and IT Services, or Critical Infrastructure will be an advantage.
- PARCO is committed to equal opportunity employment, valuing diversity and fostering an inclusive work environment designed to attract and nurture top talent.
- The position is based at PARCO’s Corporate Headquarters in Karachi.

This role offers a unique opportunity to contribute to the security posture of a major energy conglomerate while working in a dynamic and growth-oriented environment.