Penetration Tester

Gunnison Consulting Group • Washington, DC

13h • $75,000 - $87,000

About The Position

The Penetration Tester supports security assessments by planning and executing tests on web applications, infrastructure, cloud environments, and other technologies connected to the client network. The role includes developing test plans, performing vulnerability and risk analyses, automating testing processes, and mapping findings to NIST SP 800-53 controls to support compliance and improve security posture.

The position conducts security testing across IT assets, web and mobile applications, infrastructure, custom-developed software, virtual technologies, commercial off-the-shelf products, cloud implementations, common application platforms, and other technologies connected to or interacting with the Judiciary network. It develops and maintains repeatable security testing methodology, including threat modeling, mapping business requirements to security requirements, selecting controls, and defining test scenarios and cases. The Penetration Tester develops Security Test Plans, evaluates security control effectiveness, relates results to NIST SP 800-53 controls as reflected in the JISF, maintains customized testing scripts, and delivers reports.

The position requires the ability to manage concurrent assessments, document and brief findings, validate corrective actions through follow-up testing, maintain assessment records, and conduct peer reviews. A Public Trust clearance must be obtainable and maintainable. The listed salary range is $75,000–$87,000 per year, depending on factors including location, qualifications, experience, and contract and organizational requirements.

Requirements

• At least 4 years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments.
• Ability to independently execute assessments from planning and preparation through testing, findings validation, reporting, and remediation verification.
• Current penetration testing or ethical hacking certification, such as CEH, CompTIA PenTest+, OSCP, or an equivalent credential.
• Strong hands-on proficiency with Burp Suite for manual web application testing, including investigating and validating vulnerabilities beyond automated scanner results.
• Experience identifying and validating web application vulnerabilities such as SQL injection, cross-site scripting, cross-site request forgery, authentication and authorization weaknesses, and privilege escalation, using OWASP testing guidance.
• Hands-on experience with Tenable Nessus and Tenable Security Center/VSS, including configuring assessments, interpreting results, validating findings, and distinguishing actionable vulnerabilities from false positives.
• Experience performing manual host configuration and security compliance assessments against CIS Benchmarks, including validating settings and documenting deviations.
• Experience assessing databases and commercial off-the-shelf applications for vulnerabilities and insecure configurations using tools such as AppDetective, DbVisualizer, Scuba, or comparable products.
• Working knowledge of networking concepts, protocols, and operating system security sufficient to investigate findings and explain technical impact.
• Experience applying NIST security guidance, including NIST SP 800-53, and using CVE, NVD, and CVSS information to evaluate severity and prioritize remediation.
• Ability to develop security test plans and produce clear, technically accurate reports that document affected assets, reproducible findings, evidence, risk, and actionable remediation recommendations.
• Experience briefing technical findings to application owners, system administrators, developers, and customer stakeholders, and conducting follow-up testing to verify corrective actions.
• Ability to manage concurrent assessments, meet reporting deadlines, maintain assessment records, and peer-review findings and deliverables.
• Must be eligible for employment in the United States; the employer is unable to sponsor candidates.
• Ability to obtain and maintain a Public Trust clearance.

Nice To Haves

• HCL AppScan experience.
• Qualys experience.
• PlexTrac experience, particularly assessment reporting, findings management, and reporting workflow improvement.
• Federal security assessment experience, particularly with the Judiciary Information Security Framework, NIST Risk Management Framework, or CSAM.
• Experience with Acunetix, Kali Linux, SQLmap, or comparable application security testing tools.
• Experience mentoring junior testers and improving assessment procedures, reporting templates, or testing workflows.
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field.

Responsibilities

• Conduct security testing of IT assets, web and mobile applications, infrastructure, custom-developed software, virtual technologies, COTS products, cloud implementations, common application platforms, and other technologies connected to or interacting with the Judiciary network.
• Develop and maintain a repeatable security testing methodology, including threat modeling, mapping business requirements to security requirements, selecting controls, and defining test scenarios and cases.
• Develop Security Test Plans.
• Perform security testing, vulnerability analysis, and risk analysis using an industry-proven, repeatable methodology.
• Evaluate the effectiveness of security controls applicable to the systems tested.
• Relate test results to NIST SP 800-53 controls as reflected in the JISF.
• Develop, maintain, and use customized testing scripts for individual and team use.
• Develop and deliver reports as required.
• Validate findings, document evidence and remediation recommendations, and conduct follow-up testing to verify corrective actions.
• Brief technical findings to application owners, system administrators, developers, and customer stakeholders.
• Manage concurrent assessments, meet reporting deadlines, maintain assessment records, and peer-review findings and deliverables.

Benefits

• Bonus and profit-sharing opportunities, depending on company and employee performance.
• Three weeks of Personal Leave during the first year.
• 11 paid holidays each year.
• Five days of Flexible Time Off each year.
• 401(k) company match at 50% up to 10% of salary.
• Medical, dental, and vision insurance.
• Life and disability insurance.
• Public transportation subsidies.
• Certifications and training allowance of $2,500 per year.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed