:
GDIT is seeking a Penetration Tester to join our CDC team. The successful candidate will perform vulnerability assessments and penetration testing following the customers prescribed scope statement with authorities derived from the CDC’s Enterprise cyber security organization.
The Pen-Tester is responsible for protecting the company from dynamic and evolving threats. Monitors and research emerging and advanced information security threats, as well as investigating repeating trends, attacks, malicious intellectual properties, and other abnormalities. Minimizes data exposure risks by meeting all company and regulatory requirements while developing and implementing business solutions. Providing incident response solutions to ever growing threats in the cyber world.
This role is fully remote!
Please Note: This role requires anACTIVEPublic Trust
Schedule:
- This will be an 80-hour bi-weekly schedule from 8a-5p
- You will work within a team to provide support to a 24x7x365 Operation, including Federal Holidays.
This will be an 80-hour bi-weekly schedule from 8a-5p
You will work within a team to provide support to a 24x7x365 Operation, including Federal Holidays.
Responsibilities:
- Scope, develop, execute vulnerability assessments and secure configuration assessments using tools such as Burp Suite, Nmap, Metasploit and Kali Linux in order to perform the following types of testing (not all-inclusive):Network Penetration Testing - Web Application Penetration Testing - Mobile Application Penetration Testing - Red Team Simulation - Cloud Based Target Penetration Testing.
- Network Penetration Testing - Web Application Penetration Testing - Mobile Application Penetration Testing - Red Team Simulation - Cloud Based Target Penetration Testing.
- Assess NIST 800-53 Rev 4 (and later versions) controls to ensure they are implemented corrected and operating as intended
- Coordinate with the pen testing vendor(s) for system assessments in order to scope the testing.
- Perform ST&Es.
- Work with other branches within CSPO for internal “Red Team” tests on systems and system controls
- Document identified vulnerabilities, how they were discovered and how they can be reproduced.
- Analyze findings from vulnerability assessment output to determine if false positives exist and document/justify why the finding is a false positive
- Submit, review, process, analyze, follow-up on and make recommendations regarding data related to the status of Plan of Action and Milestones (POA&M), which is the documented plan to mitigate a weakness, item mitigation
- Draft reports and other correspondence related to security reviews, audits, POA&Ms Plan of Action and Milestones (POA&M) tracking and related compliance issues.
- review vulnerabilities and analyze if any false positives exist and document any false positives with justification as to why they are not legitimate and provide validation artifacts.
- Shall conduct Risk and Vulnerability Assessments (RVA) within the "Operator Role" in support of the CDC mission which includes the following:Vulnerability Scanning and Testing to conduct vulnerability assessments.Penetration Testing, which exploits weaknesses or tests responses from systems, applications, networks, and security controls.Social Engineering (Phishing), which uses e-mails: (a) as attack vectors or (b) as a means to test security awareness.Wireless Discovery and Identification, which identifies wireless signals, rogue wireless devices, and exploits access points.Web Application Scanning and Testing, which identifies web application vulnerabilities.Database Scanning, which performs a security scan of database settings and controls.Operating System Scanning, which scans operating systems to do compliance checks.
- Vulnerability Scanning and Testing to conduct vulnerability assessments.
- Penetration Testing, which exploits weaknesses or tests responses from systems, applications, networks, and security controls.
- Social Engineering (Phishing), which uses e-mails: (a) as attack vectors or (b) as a means to test security awareness.
- Wireless Discovery and Identification, which identifies wireless signals, rogue wireless devices, and exploits access points.
- Web Application Scanning and Testing, which identifies web application vulnerabilities.
- Database Scanning, which performs a security scan of database settings and controls.
- Operating System Scanning, which scans operating systems to do compliance checks.
- Conduct following task within the following methodologies:Pre-Rules of Engagement (ROE): Agency contacted, briefed on CISA Assessment Team services, requested, confirmed, and ROE signed.Pre-Assessment: Packagedistributed/received,teleconference, receive artifacts.Assessment: On- and off-site assessment activities.Reporting: Draft report submitted, receive comments.Post Assessment: Final report delivered and out brief.
- Pre-Rules of Engagement (ROE): Agency contacted, briefed on CISA Assessment Team services, requested, confirmed, and ROE signed.
- Pre-Assessment: Packagedistributed/received,teleconference, receive artifacts.
- Assessment: On- and off-site assessment activities.
- Reporting: Draft report submitted, receive comments.
- Post Assessment: Final report delivered and out brief.
Scope, develop, execute vulnerability assessments and secure configuration assessments using tools such as Burp Suite, Nmap, Metasploit and Kali Linux in order to perform the following types of testing (not all-inclusive):
Network Penetration Testing - Web Application Penetration Testing - Mobile Application Penetration Testing - Red Team Simulation - Cloud Based Target Penetration Testing.
Assess NIST 800-53 Rev 4 (and later versions) controls to ensure they are implemented corrected and operating as intended
Coordinate with the pen testing vendor(s) for system assessments in order to scope the testing.
Perform ST&Es.
Work with other branches within CSPO for internal “Red Team” tests on systems and system controls
Document identified vulnerabilities, how they were discovered and how they can be reproduced.
Analyze findings from vulnerability assessment output to determine if false positives exist and document/justify why the finding is a false positive
Submit, review, process, analyze, follow-up on and make recommendations regarding data related to the status of Plan of Action and Milestones (POA&M), which is the documented plan to mitigate a weakness, item mitigation
Draft reports and other correspondence related to security reviews, audits, POA&Ms Plan of Action and Milestones (POA&M) tracking and related compliance issues.
review vulnerabilities and analyze if any false positives exist and document any false positives with justification as to why they are not legitimate and provide validation artifacts.
Shall conduct Risk and Vulnerability Assessments (RVA) within the "Operator Role" in support of the CDC mission which includes the following:
Vulnerability Scanning and Testing to conduct vulnerability assessments.
Penetration Testing, which exploits weaknesses or tests responses from systems, applications, networks, and security controls.
Social Engineering (Phishing), which uses e-mails: (a) as attack vectors or (b) as a means to test security awareness.
Wireless Discovery and Identification, which identifies wireless signals, rogue wireless devices, and exploits access points.
Web Application Scanning and Testing, which identifies web application vulnerabilities.
Database Scanning, which performs a security scan of database settings and controls.
Operating System Scanning, which scans operating systems to do compliance checks.
Conduct following task within the following methodologies:
Pre-Rules of Engagement (ROE): Agency contacted, briefed on CISA Assessment Team services, requested, confirmed, and ROE signed.
distributed/received,
Assessment: On- and off-site assessment activities.
Reporting: Draft report submitted, receive comments.
Post Assessment: Final report delivered and out brief.
Required Experience:
- Bachelors and 5+ years of relevant experience (or equivalenteducation/experience)
- 5+ years of Penetration Testing
- Key industry certifications such as CompTIA PenTest+, C|PENT, C|EH Master, GIAC
- An active Public Trust is required
Bachelors and 5+ years of relevant experience (or equivalenteducation/experience)
5+ years of Penetration Testing
Key industry certifications such as CompTIA PenTest+, C|PENT, C|EH Master, GIAC
An active Public Trust is required
Desired Experience:
- Previous CDC experience preferred
- Ability to work well with a remote team
Previous CDC experience preferred
Ability to work well with a remote team
Scheduled Weekly Hours:
Travel Required:
Work Location:
Additional Work Locations:
Total Rewards at GDIT:
gdit.com/tc .