Security RMF Pen Tester

1 month ago

Washington, United States Hummingbirds Innovations Full time
Job DescriptionJob Description

The ideal candidate has experience performing internal penetration testing, vulnerability assessments and manual exploitation of servers, web applications/services and databases to identify vulnerabilities, misconfigurations, and compliance issues. In addition, the candidate will have extensive experience in performing FISMA technical controls assessments, writing final reports, Pen Testing Rules of Engagements (RoE), Test Plans and Standard Operating Procedures (SOPs).

Seeking experienced Security Risk Management Framework (RMF) Technical Controls Assessor and pen tester to support a Federal government client. The responsibilities for the Security RMF Technical Controls Assessor include:

  • Conduct custom penetration testing scoped to the Federal Information Security Modernization Act (FISMA) systems’ unique environment and role based on the controls, schedule, and resources concurrent with the Information System
  • Write final reports, defend all findings to include the risk or vulnerability, mitigation strategies, and references
  • Conduct internal penetration testing and vulnerability assessment of servers, web applications, web services, and databases
  • Manually exploit and compromise operating systems, web applications, and databases
  • Examine results of web/OS scanners, scans and static source code analysis
  • As needed, provide Penetration Testing, Vulnerability Scanning, and App Scanning using tools such as: Burp, Splunk, Nessus, SIH (Tripwire), AppDetective, WebInspect, Metasploit
  • Develop Penetration Testing Rules of Behavior (RoB) and deliver to team and clients
  • Understand how to create unique exploit code, bypass AV, and mimic adversarial threats
  • Help customer perform analysis and mitigation of security vulnerabilities
  • Research and maintain proficiency in tools, techniques, countermeasures, and trends in computer network vulnerabilities, data hiding, network security, and encryption
  • Work with the Assessor Lead to conduct the Authorization & Assessment (A&A) for the annual FISMA systems assessment
  • Establish the schedule and resources for the A&A of the annual FISMA systems assessments
  • Conduct verbal discussion/meeting to address progress of the A&A effort

· Prepare and update various security documentation such as Systems Security Plans (SSPs), Plan of Action and Milestones (POA&Ms), Risk Assessments, Private Impact Assessments (PIAs), and more

  • Verify that application software/network/system security postures are implemented as stated, document deviations, and recommend required actions to correct those deviations.
  • Assist in preparing Security Assessment Plans (SAP) to document test and assessment procedures
  • Collect artifacts as proof that security controls are performing effectively
  • Conduct custom interviews based on initial analysis of the system’s security plan to assess compliance with security controls
  • Conduct system specific review and assessment of applicable controls at each site to be assessed, including and remote assessments (if applicable)
  • Conduct FISMA systems Continuous Monitoring implementation and assessment
  • Validate inventories for the annual FISMA system’s assessments

· Gather and analyze sufficient artifacts to verify technical control implementation against agency security policies

  • Review relevant policies, schedule activities, and provide recommendations for courses of action

· Complete comprehensive test plans for identified security controls following National Institute of Standards and Technology (NIST 800-53), Federal Risk and Authorization Management Program (FedRAMP) guidance, and/or agency-specific guidance

  • Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence)
  • Produce complete, accurate, and timely findings reports
  • Develop documents and document templates
  • Promote an environment of continuous process improvement, learning and team collaboration

Requirements

Qualifications and Skills

  • Must be a United States citizen

· Two (2) or more years of experience with penetration testing preferred

  • Two (2) or more years of experience in technical controls assessments preferred
  • Two (2) or more years of experience with RMF preferred
  • Two (2) or more years of experience with A&A preferred
  • Must have hands-on technology experience (Engineering, Development, or Operations)

· Strong familiarity with at least one of the following: Burp Suite, Open Web Application Security Project (OWASP) top 10, Penetration Executive Standard (PTES), and National Security Agency (NSA) Vulnerability and Penetration Testing Standards

  • Familiarity with the Cyber Security Assessment and Management (CSAM) System for system assessments, or other equivalent tools
  • Previous experience with security and scanning tools such as Burp Suite, NMAP, Splunk, Nessus, SIH (Tripwire), AppDetective, WebInspect.
  • Knowledgeable with information security and assurance principles and associated supporting technologies
  • Flexibility to adapt to contingencies resulting from changes or modifications to the schedule and assessment requirements.
  • Excellent customer service and organization skills
  • Excellent oral and written communication skills
  • Experience in presenting control requirements and deficiencies to both technical and non-technical audiences

Benefits

One or more of the following certifications preferred:

o Offensive Security Certified Professional (OSCP)

o GIAC Security Leadership (GSLC)

o GIAC Penetration Tester (GPEN)

o GIAC Web Application Penetration Tester (GWAPT)

o Certified Information Systems Security Professional (CISSP)

o Certified Ethical Hacker (CEH)

o Other Penetration Testing certifications

  • Penetration Tester

    3 months ago

    Washington, United States Cyber Security Innovations Full time

    Job DescriptionJob DescriptionCSI is looking for a Penetration Tester to join our team on an upcoming Security and Privacy Assessment project in the non-profit telecommunications industry. The Pen Tester will complement risk assessments as ongoing defense against technical security threats of weakness exploitation for the same systems.This role is hybrid...

  • Lead Application Security Tester

    2 months ago

    Washington, United States Editech Staffing Full time

    Job DescriptionJob DescriptionLead Application Security Tester / Source Code ReviewOnsite / Washington, DCOur client, established in 2016, is dedicated to redefining cybersecurity landscapes through unmatched innovation that has positioned them at the forefront of the industry, is looking for a talented Lead Application Security Tester to join their team in...

  • Database Security Tester

    1 month ago

    Washington, United States Booz Allen Hamilton Full time

    Database Security TesterThe Opportunity:When our country’s cyber security is on the line, simply reacting is not enough – we need a plan. And when that plan needs to protect databases for federal financial agencies, we need SMEs to help ensure those databases are secured. That’s why we need you, a security specialist with the expertise required to...

  • Naval RMF Team Lead

    2 months ago

    Washington, United States Booz Allen Hamilton Full time

    Naval RMF Team LeadThe Opportunity:Cyber threats are everywhere, and the constantly evolving nature of these threats can make understanding them seem overwhelming to the Navy. In all of this “cyber noise,” how can these organizations understand their risks and how to mitigate them? The answer is you—an information security risk specialist who will...

  • Naval RMF Team Lead

    2 weeks ago

    Washington, United States BOOZ, ALLEN & HAMILTON, INC. Full time

    Naval RMF Team LeadThe Opportunity:Cyber threats are everywhere, and the constantly evolving nature of these threats can make understanding them seem overwhelming to the Navy. In all of this "cyber noise," how can these organizations understand their risks and how to mitigate them? The answer is you-an information security risk spe cia list who will break...

  • Mobile Application Security Tester

    1 month ago

    Washington, United States Editech Staffing Full time

    *Editech Staffing does not partner with external agencies, no C2C, no sponsorship *In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire. *Completion of I-9, verifying US work authorizationWashington D.C...

  • Application Security Tester

    5 days ago

    Washington, Washington, D.C., United States ASCENDING Full time

    Job OverviewLocation: 100% Remote within United StatesPosition Summary:We are looking for a talented Application Security Tester to join the ASCENDING team in a long-term contract role. This position requires hands-on expertise in application security testing, focusing on uncovering vulnerabilities and collaborating with development teams to address security...

  • Lead Mobile Application Security Tester

    1 month ago

    Washington, United States Editech Staffing Full time

    Job DescriptionJob Description*Editech Staffing does not partner with external agencies, no C2C, no sponsorship*In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.*Completion of I-9, verifying US work...

  • Naval RMF Team Lead

    10 hours ago

    Washington, Washington, D.C., United States Booz Allen Hamilton Full time

    Naval RMF Team Lead Opportunity OverviewWe are seeking an experienced information security risk specialist to assist the Navy in identifying and mitigating risks associated with their IT systems and weapon systems. As a Naval RMF Team Lead, you will play a critical role in helping the Navy tackle cyber threats.Key Responsibilities:Assess and mitigate risks...

  • Mobile Application Security Tester

    1 month ago

    Washington, United States Editech Staffing Full time

    Job DescriptionJob Description*Editech Staffing does not partner with external agencies, no C2C, no sponsorship*In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.*Completion of I-9, verifying US work...

  • Penetration Tester

    3 months ago

    Washington, United States Graham Technologies Full time

    Job DescriptionJob DescriptionJob Overview:Graham Technologies (GTECH) is seeking a Penetration Tester whose primary duties will be providing penetration tests to find, exploit, and report technical risks and recommending steps to remove, mitigate, or avoid each discovered technical risk and weakness.You will be happy to know that this is a hybrid position....

  • Application Security Tester and Source Code Review

    2 months ago

    Washington, United States Editech Staffing Full time

    Job DescriptionJob DescriptionApplication Security Tester and Source Code Review Onsite / Washington, DCOur client is seeking a Application Security Tester and Source Code Review professional to join a great team! This role is tailor-made for someone who brings passion, expertise, and a visionary outlook to the tablesomeone who is ready to drive projects...

  • Junior Penetration Tester

    3 months ago

    Washington, United States Gunnison Consulting Group Inc Full time

    Job DescriptionJob DescriptionDuties and responsibilities:Conduct security testing of IT assets, web applications, infrastructure assets and technologies, mobile applications, custom developed software implementations, virtual technologies, COTS products, cloud implementations, common application platforms, and other technologies connecting to or interacting...

  • Artificial Intelligence RMF Policy and Documentation Specialist

    4 days ago

    Washington, United States GBS Solutions Full time $110,000 - $130,000

    Job DescriptionJob DescriptionWe are actively recruiting for an Artificial Intelligence RMF Policy and Documentation Specialist. GBS offers Medical, Dental, Vision, 401k and 401k Match, STD, LTD and Life Insurance with Accidental Death and Dismemberment, Voluntary Life Insurance with Accidental Death and Dismemberment and Paid Time Off.GBS Solutions...

  • Penetration Tester

    4 weeks ago

    Washington, United States Experis Full time

    Position: Penetration Tester Location: Washington DC (metro accessible) Duration: 6 Month Contract with likely extension Hybrid:  on site 3 days a week Experis is partnered with a global financial organization in their search for a Penetration Tester to join their team in Washington, DC. Candidate must have strong manual penetration experience, as well as...

  • Senior Penetration Tester

    1 week ago

    Washington, United States New Light Technologies In Full time $110,000 - $150,000

    Job DescriptionJob DescriptionSenior Penetration Tester**Location**: Washington, DC (Remote with potential onsite requirements)**Reports To**: Chief Information Security Officer (CISO)**Contract Type**: Labor-Hour**Position Summary**:The Senior Penetration Tester will be responsible for conducting regular and ad-hoc penetration testing of the HBX's...

  • Security Control Assessor

    2 weeks ago

    Washington, United States Expentor Inc Full time

    Job DescriptionJob DescriptionSecurity Control Assessment and Validation: Provide Security Control Assessors/Validators with experience in Navy Authorization and Accreditation (A&A), including Test and Evaluation (T&E) and Risk Management Framework (RMF) processes.QualificationsIAT Level II/III or IAM Level IIIBachelor's Degree or higher7+ years of...

  • Security Assessment Specialist

    6 days ago

    Washington, Washington, D.C., United States Cyber Security Innovations Full time

    Job OverviewCyber Security Innovations is seeking a Security Assessment Specialist to become a vital part of our team for an upcoming Security and Privacy Evaluation initiative within the non-profit telecommunications sector. This role is essential in fortifying our defenses against potential technical security vulnerabilities.This position offers a hybrid...

  • Information Security Engineer

    3 hours ago

    Washington, Washington, D.C., United States Booz Allen Hamilton Full time

    Position Overview:The Cybersecurity Engineer will play a pivotal role in supporting AI-enhanced software solutions to achieve Authority to Operate (ATO) within IL 4-6 level environments. This position involves designing, developing, and implementing software solutions and systems that conduct extensive cyber data analytics across diverse technology...

  • Information Security Engineer

    6 days ago

    Washington, Washington, D.C., United States Booz Allen Hamilton Full time

    Position Overview:The Cybersecurity Engineer will play a pivotal role in enhancing the security posture of our AI-driven software solutions. This position involves collaborating with teams to secure Authorization to Operate (ATO) within IL 4-6 level environments. The engineer will design, develop, and implement software solutions that enable extensive cyber...