[Hiring] Penetration Tester @Gunnison Consulting Group

Role Description

The Penetration Tester supports security assessments by planning and executing tests on web applications, infrastructure, cloud environments, and other technologies connected to the client network. Responsibilities include:

• Developing test plans
• Performing vulnerability and risk analyses
• Automating testing processes
• Mapping findings to NIST SP 800-53 controls to ensure compliance and improve security posture

Conduct security testing of:

• IT assets
• Web applications
• Infrastructure assets and technologies
• Mobile applications
• Custom developed software implementations
• Virtual technologies
• COTS products
• Cloud implementations
• Common application platforms
• Other technologies connecting to or interacting with the Judiciary network

• Develop and maintain a repeatable methodology for performing security testing
• Security test planning should include:
  • Threat modeling
  • Mapping business requirements to applicable security requirements
  • Determining appropriate security controls
  • Test scenarios and test cases
• Develop the Security Test Plans
• Perform security testing, vulnerability analysis, and risk analysis in accordance with an industry-proven, repeatable methodology
• Evaluate the effectiveness of security controls as they relate to the applicable security controls of the system tested
• Relate test results to controls in NIST SP 800-53, as reflected in the JISF
• Develop, maintain and use customized testing scripts (testing automation) for individual and team use
• Develop and deliver reports as required

Qualifications

• 4+ years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments
• Demonstrated ability to independently execute security assessments from planning and preparation through testing, findings validation, reporting, and remediation verification
• Current penetration testing or ethical hacking certification, such as CEH, CompTIA PenTest+, OSCP, or an equivalent credential
• Strong hands-on proficiency with Burp Suite for manual web application testing
• Experience identifying and validating web application vulnerabilities, including:
  • SQL injection
  • Cross-site scripting
  • Cross-site request forgery
  • Authentication and authorization weaknesses
  • Privilege escalation
• Hands-on experience with Tenable Nessus and Tenable Security Center/VSS
• Experience performing manual host configuration and security compliance assessments against CIS Benchmarks
• Experience assessing databases and commercial off-the-shelf applications for vulnerabilities and insecure configurations
• Working knowledge of networking concepts, protocols, and operating system security
• Experience applying NIST security guidance, including NIST SP 800-53
• Ability to develop security test plans and produce clear, technically accurate reports
• Experience briefing technical findings to various stakeholders
• Ability to manage concurrent assessments, meet reporting deadlines, and perform peer reviews of findings and deliverables

Requirements

• HCL AppScan experience
• Qualys experience
• PlexTrac experience, particularly assessment reporting, findings management, and reporting workflow improvement
• Federal security assessment experience, particularly with the Judiciary Information Security Framework, NIST Risk Management Framework, or CSAM
• Experience with Acunetix, Kali Linux, SQLmap, or comparable application security testing tools
• Experience mentoring junior testers and improving assessment procedures, reporting templates, or testing workflows
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field

Benefits

• 3 weeks of Personal Leave your first year
• 11 paid Holidays each year
• 5 days of Flexible Time Off each year
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - $2,500/year!