Vulnerability Senior Analyst

The Penetration Tester supports security assessments by planning and executing tests on web applications, infrastructure, cloud environments, and other technologies connected to the client network. Responsibilities include developing test plans, performing vulnerability and risk analyses, automating testing processes, and mapping findings to NIST SP 800-53 controls to ensure compliance and improve security posture.
Conduct security testing of IT assets, web applications, infrastructure assets and technologies, mobile applications, custom developed software implementations, virtual technologies, COTS products, cloud implementations, common application platforms, and other technologies connecting to or interacting with the Judiciary network.
Develop and maintain a repeatable methodology for performing security testing. Security test planning should include, but is not limited to: threat modeling, map business requirements to the applicable security requirements, determine appropriate security controls, test scenarios and test cases.
Perform security testing, vulnerability analysis, and risk analysis in accordance with an industry-proven, repeatable methodology.
Develop, maintain and use customized testing scripts (testing automation) for individual and team use.
4+ years of hands-on cybersecurity assessment experience, including manual penetration testing, web application security testing, and host vulnerability assessments.
~ Demonstrated ability to independently execute security assessments from planning and preparation through testing, findings validation, reporting, and remediation verification.
~ Current penetration testing or ethical hacking certification, such as

CEH, CompTIA PenTest+, OSCP, or an equivalent credential

.
~ Strong hands-on proficiency with Burp Suite for manual web application testing. Experience identifying and validating web application vulnerabilities, including SQL injection, cross-site scripting, cross-site request forgery, authentication and authorization weaknesses, and privilege escalation, using OWASP testing guidance.
~ Experience performing manual host configuration and security compliance assessments against CIS Benchmarks, including validating settings and documenting deviations.
~ Experience assessing databases and commercial off-the-shelf applications for vulnerabilities and insecure configurations, using tools such as AppDetective, DbVisualizer, Scuba, or comparable products.
~ Working knowledge of networking concepts, protocols, and operating system security sufficient to investigate findings and explain their technical impact.
~ Ability to develop security test plans and produce clear, technically accurate reports documenting affected assets, reproducible findings, supporting evidence, risk, and actionable remediation recommendations.
~ Experience briefing technical findings to application owners, system administrators, developers, and customer stakeholders, and conducting follow-up testing to verify corrective actions.
~ Federal security assessment experience, particularly with the Judiciary Information Security Framework, NIST Risk Management Framework, or CSAM.
Experience with Acunetix, Kali Linux, SQLmap, or comparable application security testing tools.
Experience mentoring junior testers and improving assessment procedures, reporting templates, or testing workflows.
Bachelor’s degree in cybersecurity, computer science, information technology, or a related technical field.
The salary range for this position depends upon multiple factors including location, the individuals knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements.
Gunnison Consulting Groups total compensation package also includes bonus and profit-sharing opportunities, depending on company and employee performance. 3 weeks of Personal Leave your first year
~11 paid Holidays each year
~5 days of Flexible Time Off each year
~Medical, Dental and Vision Insurance
~ Life and Disability Insurance
~ Certifications and Training Allowance - $2,500/year!

Gunnison takes on ambitious projects. We target fun, challenging work that requires creative thinking and innovation.
Quality is our top priority.
In 1994 Gunnison began serving the greater Washington, D.C. metro area, focused on tackling our customers most ambitious technology projects

.

By creating a culture dedicated to enabling our customers and employees to achieve more than they ever thought they could

,

the company has thrived for over 25 years.