General Mills

Position Title

D&T Analyst II – Cyber Security, Red Team

Function/Group

Digital & Technology

Location

Mumbai

Shift Timing

11AM to 8PM IST

Role Reports to

D&T Cyber Security, Red Team Manager

Remote/Hybrid/in-Office

Hybrid

ABOUT GENERAL MILLS

We make food the world loves: 100 brands. In 100 countries. Across six continents. With iconic brands like Cheerios, Pillsbury, Betty Crocker, Nature Valley, and Häagen-Dazs, we’ve been serving up food the world loves for 155 years (and counting). Each of our brands has a unique story to tell.

How we make our food is as important as the food we make. Our values are baked into our legacy and continue to accelerate

us into the future as an innovative force for good. General Mills was founded in 1866 when Cadwallader Washburn boldly bought the largest flour mill west of the Mississippi. That pioneering spirit lives on today through our leadership team who upholds a vision of relentless innovation while being a force for good. For more details check out http://www.generalmills.com

General Mills India Center (GIC) is our global capability center in Mumbai that works as an extension of our global organization delivering business value, service excellence and growth, while standing for good for our planet and people.

With our team of 1800+ professionals, we deliver superior value across the areas of Supply chain (SC) , Digital & Technology (D&T) Innovation, Technology & Quality (ITQ), Consumer and Market Intelligence (CMI), Sales Strategy & Intelligence (SSI) , Global Shared Services (GSS) , Finance Shared Services (FSS) and Human Resources Shared Services (HRSS).For more details check out https://www.generalmills.co.in

We advocate for advancing equity and inclusion to create more equitable workplaces and a better tomorrow.

JOB OVERVIEW

Function Overview

The Digital and Technology team at General Mills stands as the largest and foremost unit, dedicated to exploring the latest trends and innovations in technology while leading the adoption of cutting-edge technologies across the organization. Collaborating closely with global business teams, the focus is on understanding business models and identifying opportunities to leverage technology for increased efficiency and disruption. The team's expertise spans a wide range of areas, including AI/ML, Data Science, IoT, NLP, Cloud, Infrastructure, RPA and Automation, Digital Transformation, Cyber Security, Blockchain, SAP S4 HANA and Enterprise Architecture. The MillsWorks initiative embodies an agile@scale delivery model, where business and technology teams operate cohesively in pods with a unified mission to deliver value for the company. Employees working on significant technology projects are recognized as Digital Transformation change agents.

The team places a strong emphasis on service partnerships and employee engagement with a commitment to advancing equity and supporting communities. In fostering an inclusive culture, the team values individuals passionate about learning and growing with technology, exemplified by the "Work with Heart" philosophy, emphasizing results over facetime. Those intrigued by the prospect of contributing to the digital transformation journey of a Fortune 500 company are encouraged to explore more details about the function through the following Link

Purpose of the role

General Mills is seeking a highly motivated and skilled Red Teamer to join our dynamic cybersecurity team. In this role, you will be responsible for simulating real-world attack scenarios to identify vulnerabilities, test security controls, and improve our overall security posture. You will conduct monthly rule testing assignments, perform purple/red team exercises, and collaborate closely with the Blue Team to enhance detection and response capabilities. The ideal candidate will possess a strong understanding of attack TTPs, excellent technical skills across various security domains, and a passion for continuous learning and improvement.

KEY ACCOUNTABILITIES

Red Team Simulations:

• Plan, execute, and document red/purple team engagements to simulate attacks against General Mills' infrastructure, applications, and data
• Develop and maintain red team tools, techniques, and procedures (TTPs) to emulate real-world adversaries
• Conduct thorough reconnaissance, vulnerability assessments, and exploitation to identify weaknesses in our security defences
• Analyze and document findings from red team engagements, providing clear and actionable recommendations for remediation

Purple Team Collaboration:

• Collaborate with the Blue Team to share knowledge, insights, and best practices
• Participate in purple team exercises to improve detection and response capabilities
• Provide guidance and mentorship to junior team members

Rule Testing and Validation:

• Conduct monthly rule testing assignments to validate the effectiveness of SIEM rules and detection capabilities
• Simulate attacker behaviour to trigger alerts and verify that security controls are functioning as intended
• Identify gaps in detection coverage and work with the Blue Team to improve rule accuracy and effectiveness

Security Research and Development:

• Stay up-to-date on the latest attack techniques, security vulnerabilities, and industry trends
• Conduct research to identify new and emerging threats
• Develop and maintain a library of attack simulations and scenarios
• Contribute to lab building activities to evaluate new TTPs, create, obfuscate and test and to perform research & development led activities

Reporting and Communication:

• Prepare clear and concise reports summarizing monthly rule testing/simulation activities, findings, and recommendations
• Communicate effectively with stakeholders at all levels of the organization

MINIMUM QUALIFICATIONS

• Education – Full time graduation from an accredited university (Mandatory- Note: This is the minimum education criteria which cannot be altered)
• 4-6 years of experience in cybersecurity, with a focus on red teaming or penetration testing
• In-depth knowledge of attack TTPs, including the MITRE ATT&CK framework
• Experience with Active Directory security principles and best practices
• Strong understanding of networking concepts, protocols, and security
• Experience with cloud security concepts and technologies (e.g., AWS, Azure, GCP)
• Solid understanding of Windows and Linux operating systems security
• Proficiency in scripting languages such as Python, PowerShell, Go or Bash
• Knowledge of application and mobile security concepts

Competencies/Behaviors required for job

• High levels of judgments, ethics and discretion
• Excellent analytical and conceptual problem-solving skills
• Innate curiosity and desire to lean with a strong inclination to drive for results in ambiguous spaces
• Strong communication and interpersonal skills

PREFERRED QUALIFICATIONS

• Knowledge of incident response processes and procedures
• Familiarity with common security frameworks and standards, such as NIST, ISO 27001, and PCI DSS
• Presentation/Participation at security conferences
• Published security blog spots, created/contributed to opensource security tool
• Participation in bug bounty programs
• Relevant certifications such as CRTP/E/M, CRTO I/II, OSCP, OSCE, GPEN, or GWAPT
• Participations/solving CTFs, online pro labs such as Hack the box, immersive or others are highly desirable

Read Full Description