Penetration Tester

Gunnison; Washington (District of Columbia); Presencial; USD 75.000 - 87.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Personal Leave (3 weeks)

11 paid holidays

Flexible Time Off (5 days)

401(k) company match

Medical, Dental & Vision Insurance

Life and Disability Insurance

Public Transportation Subsidies

Certifications and Training Allowance

Descripción de la vacante

Gunnison in Washington, DC seeks a seasoned Penetration Tester to plan and execute security tests across web apps, infrastructure, cloud, and related technologies. You will map findings to NIST SP 800-53 controls and develop repeatable testing methodologies.

Responsibilities include vulnerability analysis, test plan development, and clear reporting with remediation guidance. Strong certification and hands-on testing experience are required to advance security posture.

Formación

• 4+ years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments.
• Must independently execute security assessments from planning to remediation verification.
• Current penetration testing or ethical hacking certification (CEH, PenTest+, OSCP, or equivalent).
• Proficiency with Burp Suite for manual testing; validate vulnerabilities beyond automated scanners.
• Experience identifying web app vulnerabilities (SQLi, XSS, CSRF, auth weaknesses, privilege escalation) per OWASP guidance.
• Experience with Nessus and Tenable tools; interpret results and distinguish true findings from false positives.
• Experience with CIS Benchmarks assessments and non-compliant deviations documented.
• Experience assessing databases and COTS apps using AppDetective, DbVisualizer, Scuba, or similar tools.
• Knowledge of networking concepts and OS security; ability to explain technical impact.
• Apply NIST SP 800-53 guidance; use CVE/NVD/CVSS to prioritize remediation.
• Develop security test plans and produce clear, actionable remediation reports.
• Brief stakeholders and perform follow-up testing to verify corrective actions.

Responsabilidades

• Conduct security testing of IT assets, web apps, infrastructure, cloud, and related technologies.
• Develop and maintain a repeatable security testing methodology and test plans.
• Perform security testing, vulnerability analysis, and risk analysis per industry methods.
• Evaluate effectiveness of security controls against NIST SP 800-53 controls.
• Relate test results to applicable controls and the JISF framework.
• Develop, maintain and use automated testing scripts for team use.
• Develop and deliver formal reports on findings and remediation recommendations.

Conocimientos

Penetration testing

Web application testing

Vulnerability analysis

Threat modeling

Security reporting

Communication

Team coordination

Educación

Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field

Herramientas

Burp Suite

Tenable Nessus

Tenable Security Center/VSS

AppDetective

DbVisualizer

Scuba

Acunetix

Kali Linux

SQLmap

PlexTrac

HCL AppScan

Qualys

Descripción del empleo

Salary range: $75,000 - $87,000/year The Penetration Tester supports security assessments by planning and executing tests on web applications, infrastructure, cloud environments, and other technologies connected to the client network. Responsibilities include developing test plans, performing vulnerability and risk analyses, automating testing processes, and mapping findings to NIST SP 800-53 controls to ensure compliance and improve security posture.

Description

• Conduct security testing of IT assets, web applications, infrastructure assets and technologies, mobile applications, custom developed software implementations, virtual technologies, COTS products, cloud implementations, common application platforms, and other technologies connecting to or interacting with the Judiciary network.
• Develop and maintain a repeatable methodology for performing security testing. Security test planning should include, but is not limited to: threat modeling, map business requirements to the applicable security requirements, determine appropriate security controls, test scenarios and test cases.
• Develop the Security Test Plans.
• Perform security testing, vulnerability analysis, and risk analysis in accordance with an industry-proven, repeatable methodology.
• Evaluate the effectiveness of security controls as they relate to the applicable security controls of the system tested.
• Relate test results to controls in NIST SP 800-53, as reflected in the JISF.
• Develop, maintain and use customized testing scripts (testing automation) for individual and team use.
• Develop and deliver reports as required.

Requirements

• 4+ years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments.
• Demonstrated ability to independently execute security assessments from planning and preparation through testing, findings validation, reporting, and remediation verification.
• Current penetration testing or ethical hacking certification, such as CEH, CompTIA PenTest+, OSCP, or an equivalent credential.
• Strong hands‑on proficiency with Burp Suite for manual web application testing. Must be able to investigate and validate vulnerabilities beyond automated scanner results.
• Experience identifying and validating web application vulnerabilities, including SQL injection, cross-site scripting, cross-site request forgery, authentication and authorization weaknesses, and privilege escalation, using OWASP testing guidance.
• Hands‑on experience with Tenable Nessus and Tenable Security Center/VSS, including configuring assessments, interpreting results, validating findings, and distinguishing actionable vulnerabilities from false positives.
• Experience performing manual host configuration and security compliance assessments against CIS Benchmarks, including validating settings and documenting deviations.
• Experience assessing databases and commercial off-the-shelf applications for vulnerabilities and insecure configurations, using tools such as AppDetective, DbVisualizer, Scuba, or comparable products.
• Working knowledge of networking concepts, protocols, and operating system security sufficient to investigate findings and explain their technical impact.
• Experience applying NIST security guidance, including NIST SP 800-53, and using CVE, NVD, and CVSS information to evaluate vulnerability severity and prioritize remediation.
• Ability to develop security test plans and produce clear, technically accurate reports documenting affected assets, reproducible findings, supporting evidence, risk, and actionable remediation recommendations.
• Experience briefing technical findings to application owners, system administrators, developers, and customer stakeholders, and conducting follow-up testing to verify corrective actions.
• Ability to manage concurrent assessments, meet reporting deadlines, maintain assessment records, and perform peer reviews of findings and deliverables.

Preferred Qualifications

• HCL AppScan experience.
• Qualys experience.
• PlexTrac experience, particularly assessment reporting, findings management, and reporting workflow improvement.
• Federal security assessment experience, particularly with the Judiciary Information Security Framework, NIST Risk Management Framework, or CSAM.
• Experience with Acunetix, Kali Linux, SQLmap, or comparable application security testing tools.
• Experience mentoring junior testers and improving assessment procedures, reporting templates, or testing workflows.
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field.

Clearance

Ability to obtain and maintain a Public Trust required.

The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements.

Benefits

• 3 weeks of Personal Leave your first year
• 11 paid Holidays each year
• 5 days of Flexible Time Off each year
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - $2,500/year!

Why Join Gunnison?

• Gunnison takes on ambitious projects. We target fun, challenging work that requires creative thinking and innovation.
• Quality is our top priority.
• Gunnison employee benefits meet or exceed what other companies in the Washington, D.C. metropolitan area offer.
• There is a great sense of camaraderie at Gunnison. This is an atmosphere we will maintain as we continue to grow.
• We are growing rapidly and the opportunity for individual professional growth with Gunnison is outstanding.
• We hire for careers at Gunnison, not to fill a position.

Equal Opportunity Employer. Must be eligible for employment in the United States. We are unable to sponsor candidates at this time.

In 1994 Gunnison began serving the greater Washington, D.C. metro area, focused on tackling our customers' most ambitious technology projects. By creating a culture dedicated to enabling our customers and employees to achieve more than they ever thought they could, the company has thrived for over 25 years.