Penetration Tester in Fairfax, Virginia

Req ID: RQ190621

Type of Requisition: Regular

Clearance Level Must Be Able to Obtain: None

Public Trust/Other Required: Other

Job Family: Cyber Security

Skills:

Cybersecurity,Information Security,Penetration Testing,Penetration Testing Software,Physical Penetration Testing

Experience:

5 + years of related experience

US Citizenship Required:

Yes

Job Description:

Job Description

GDIT is seeking a Penetration Tester to join our CDC team. The successful candidate will perform vulnerability assessments and penetration testing following the customers prescribed scope statement with authorities derived from the CDC’s Enterprise cyber security organization.

The Pen-Tester is responsible for protecting the company from dynamic and evolving threats. Monitors and research emerging and advanced information security threats, as well as investigating repeating trends, attacks, malicious intellectual properties, and other abnormalities. Minimizes data exposure risks by meeting all company and regulatory requirements while developing and implementing business solutions. Providing incident response solutions to ever growing threats in the cyber world.

This role is fully remote!

Please Note: This role requires an ACTIVE Public Trust

Schedule:

• This will be an 80-hour bi-weekly schedule from 8a-5p

• You will work within a team to provide support to a 24x7x365 Operation, including Federal Holidays.

Responsibilities:

• Scope, develop, execute vulnerability assessments and secure configuration assessments using tools such as Burp Suite, Nmap, Metasploit and Kali Linux in order to perform the following types of testing (not all-inclusive):

• Network Penetration Testing – Web Application Penetration Testing – Mobile Application Penetration Testing – Red Team Simulation – Cloud Based Target Penetration Testing.

• Assess NIST 800-53 Rev 4 (and later versions) controls to ensure they are implemented corrected and operating as intended

• Coordinate with the pen testing vendor(s) for system assessments in order to scope the testing.

• Perform ST&Es.

• Work with other branches within CSPO for internal “Red Team” tests on systems and system controls

• Document identified vulnerabilities, how they were discovered and how they can be reproduced.

• Analyze findings from vulnerability assessment output to determine if false positives exist and document/justify why the finding is a false positive

• Submit, review, process, analyze, follow-up on and make recommendations regarding data related to the status of Plan of Action and Milestones (POA&M), which is the documented plan to mitigate a weakness, item mitigation

• Draft reports and other correspondence related to security reviews, audits, POA&Ms Plan of Action and Milestones (POA&M) tracking and related compliance issues.

• review vulnerabilities and analyze if any false positives exist and document any false positives with justification as to why they are not legitimate and provide validation artifacts.

• Shall conduct Risk and Vulnerability Assessments (RVA) within the “Operator Role” in support of the CDC mission which includes the following:

• Vulnerability Scanning and Testing to conduct vulnerability assessments.

• Penetration Testing, which exploits weaknesses or tests responses from systems, applications, networks, and security controls.

• Social Engineering (Phishing), which uses e-mails: (a) as attack vectors or (b) as a means to test security awareness.

• Wireless Discovery and Identification, which identifies wireless signals, rogue wireless devices, and exploits access points.

• Web Application Scanning and Testing, which identifies web application vulnerabilities.

• Database Scanning, which performs a security scan of database settings and controls.

• Operating System Scanning, which scans operating systems to do compliance checks.

• Conduct following task within the following methodologies:

• Pre-Rules of Engagement (ROE): Agency contacted, briefed on CISA Assessment Team services, requested, confirmed, and ROE signed.

• Pre-Assessment: Package distributed/received, teleconference, receive artifacts.

• Assessment: On- and off-site assessment activities.

• Reporting: Draft report submitted, receive comments.

• Post Assessment: Final report delivered and out brief.

Required Experience:

• Bachelors and 5+ years of relevant experience (or equivalent education/experience)

• 5+ years of Penetration Testing

• Key industry certifications such as CompTIA PenTest+, CPENT, CEH Master, GIAC

• An active Public Trust is required

Desired Experience:

• Previous CDC experience preferred

• Ability to work well with a remote team

The likely salary range for this position is $106,371 – $129,950. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.

Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. GDIT typically provides new employees with 15 days of paid leave per calendar year to be used for vacations, personal business, and illness and an additional 10 paid holidays per year. Paid leave and paid holidays are prorated based on the employee’s date of hire. The GDIT Paid Family Leave program provides a total of up to 160 hours of paid leave in a rolling 12 month period for eligible employees. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.

We are GDIT. A global technology and professional services company that delivers consulting, technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 30,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 30 countries worldwide, offering leading capabilities in digital modernization, AI/ML, Cloud, Cyber and application development. Together with our clients, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology.

We connect people with the most impactful client missions, creating an unparalleled work experience that allows them to see their impact every day. We create opportunities for our people to lead and learn simultaneously. From securing our nation’s most sensitive systems, to enabling digital transformation and cloud adoption, our people are the ones who make change real.

GDIT is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status, or any other protected class.