Penetration Tester

Job Description: - Conduct security testing of IT assets, web applications, infrastructure, mobile applications, custom software, virtual technologies, COTS products, cloud implementations, application platforms, and other technologies connected to the Judiciary network

• Develop and maintain a repeatable security testing methodology
• Perform threat modeling and map business requirements to applicable security requirements
• Determine appropriate security controls, test scenarios, and test cases
• Develop Security Test Plans
• Perform security testing, vulnerability analysis, and risk analysis
• Evaluate the effectiveness of security controls
• Map test results to NIST SP 800-53 controls as reflected in the JISF
• Develop, maintain, and use customized testing scripts for automation
• Develop and deliver required reports
• Validate findings, verify remediation, and brief technical findings to stakeholders
• Manage concurrent assessments, maintain assessment records, and perform peer reviews of findings and deliverables

Requirements: - 4+ years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments

• Ability to independently execute security assessments from planning and preparation through testing, findings validation, reporting, and remediation verification
• Current penetration testing or ethical hacking certification, such as CEH, CompTIA PenTest+, OSCP, or an equivalent credential
• Strong hands-on proficiency with Burp Suite
• Ability to investigate and validate vulnerabilities beyond automated scanner results
• Experience identifying and validating SQL injection, cross-site scripting, cross-site request forgery, authentication and authorization weaknesses, and privilege escalation using OWASP testing guidance
• Hands-on experience with Tenable Nessus and Tenable Security Center/VSS
• Experience performing manual host configuration and security compliance assessments against CIS Benchmarks
• Experience assessing databases and commercial off-the-shelf applications using tools such as AppDetective, DbVisualizer, Scuba, or comparable products
• Working knowledge of networking concepts, protocols, and operating system security
• Experience applying NIST security guidance, including NIST SP 800-53
• Experience using CVE, NVD, and CVSS information to evaluate vulnerability severity and prioritize remediation
• Ability to develop security test plans and produce clear, technically accurate reports
• Experience briefing technical findings to application owners, system administrators, developers, and customer stakeholders
• Ability to manage concurrent assessments, meet reporting deadlines, maintain assessment records, and perform peer reviews
• Ability to obtain and maintain a Public Trust
• Must be eligible for employment in the United States
• Unable to sponsor candidates at this time

Benefits: - 3 weeks of Personal Leave your first year

• 11 paid Holidays each year
• 5 days of Flexible Time Off each year
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - $2,500/year
• Bonus and profit-sharing opportunities, depending on company and employee performance