Penetration Tester

Gunnison Consulting Group • Washington, DC

5d

About The Position

The Penetration Tester supports security assessments by planning and executing tests on web applications, infrastructure, cloud environments, and other technologies connected to the client network. The role involves conducting security testing across IT assets, mobile applications, custom-developed software, virtual technologies, commercial off-the-shelf products, cloud implementations, common application platforms, and other technologies connected to or interacting with the Judiciary network.

The tester develops and maintains a repeatable security testing methodology and plans that incorporate threat modeling, mapping business requirements to security requirements, selecting appropriate controls, and defining test scenarios and cases. The role performs vulnerability and risk analyses, evaluates security control effectiveness, maps results to NIST SP 800-53 controls as reflected in the JISF, and develops and uses customized testing automation scripts. The tester also prepares reports, communicates findings to stakeholders, and conducts follow-up testing to verify remediation.

Requirements

• At least 4 years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments.
• Current penetration testing or ethical hacking certification, such as CEH, CompTIA PenTest+, OSCP, or an equivalent credential.
• Strong hands-on proficiency with Burp Suite for manual web application testing.
• Experience identifying and validating web application vulnerabilities, including SQL injection, cross-site scripting, cross-site request forgery, authentication and authorization weaknesses, and privilege escalation, using OWASP testing guidance.
• Hands-on experience with Tenable Nessus and Tenable Security Center/VSS, including configuring assessments, interpreting results, validating findings, and distinguishing actionable vulnerabilities from false positives.
• Experience performing manual host configuration and security compliance assessments against CIS Benchmarks, including validating settings and documenting deviations.
• Experience assessing databases and commercial off-the-shelf applications for vulnerabilities and insecure configurations, using tools such as AppDetective, DbVisualizer, Scuba, or comparable products.
• Working knowledge of networking concepts, protocols, and operating system security sufficient to investigate findings and explain their technical impact.
• Experience applying NIST security guidance, including NIST SP 800-53, and using CVE, NVD, and CVSS information to evaluate vulnerability severity and prioritize remediation.
• Ability to develop security test plans and produce clear, technically accurate reports documenting affected assets, reproducible findings, supporting evidence, risk, and actionable remediation recommendations.
• Experience briefing technical findings to application owners, system administrators, developers, and customer stakeholders, and conducting follow-up testing to verify corrective actions.
• Ability to manage concurrent assessments, meet reporting deadlines, maintain assessment records, and perform peer reviews of findings and deliverables.
• Ability to obtain and maintain a Public Trust.
• Must be eligible for employment in the United States; the employer is unable to sponsor candidates.

Nice To Haves

• HCL AppScan experience.
• Qualys experience.
• PlexTrac experience, particularly assessment reporting, findings management, and reporting workflow improvement.
• Federal security assessment experience, particularly with the Judiciary Information Security Framework, NIST Risk Management Framework, or CSAM.
• Experience with Acunetix, Kali Linux, SQLmap, or comparable application security testing tools.
• Experience mentoring junior testers and improving assessment procedures, reporting templates, or testing workflows.
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field.

Responsibilities

• Conduct security testing of IT assets, web applications, infrastructure, mobile applications, custom-developed software, virtual technologies, COTS products, cloud implementations, common application platforms, and other technologies connected to or interacting with the Judiciary network.
• Develop and maintain a repeatable methodology for security testing.
• Develop security test plans that include threat modeling, mapping business requirements to applicable security requirements, determining appropriate security controls, and defining test scenarios and test cases.
• Perform security testing, vulnerability analysis, and risk analysis using an industry-proven, repeatable methodology.
• Evaluate the effectiveness of security controls in relation to the applicable controls for the system being tested.
• Map test results to NIST SP 800-53 controls as reflected in the JISF.
• Develop, maintain, and use customized testing scripts and testing automation for individual and team use.
• Develop and deliver reports as required.
• Independently execute assessments from planning and preparation through testing, findings validation, reporting, and remediation verification.
• Investigate and validate vulnerabilities beyond automated scanner results, including web application vulnerabilities and host configuration issues.
• Configure assessments, interpret results, validate findings, and distinguish actionable vulnerabilities from false positives.
• Perform manual host configuration and security compliance assessments against CIS Benchmarks, validate settings, and document deviations.
• Assess databases and COTS applications for vulnerabilities and insecure configurations.
• Use CVE, NVD, and CVSS information to evaluate vulnerability severity and prioritize remediation.
• Produce technically accurate reports documenting affected assets, reproducible findings, supporting evidence, risk, and actionable remediation recommendations.
• Brief technical findings to application owners, system administrators, developers, and customer stakeholders, and conduct follow-up testing to verify corrective actions.
• Manage concurrent assessments, meet reporting deadlines, maintain assessment records, and perform peer reviews of findings and deliverables.

Benefits

• Bonus and profit-sharing opportunities, depending on company and employee performance.
• Three weeks of Personal Leave in the first year.
• 11 paid holidays each year.
• Five days of Flexible Time Off each year.
• 401(k) company match at 50% up to 10% of salary.
• Medical, dental, and vision insurance.
• Life and disability insurance.
• Public transportation subsidies.
• Certifications and training allowance of $2,500 per year.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed