Job Type
Full-time
Description
* This position is contingent upon a future opening with Gunnison.
Salary: $125,000-$145,000
Work location: Hybrid, 2-3 days per week on-site in Alexandria, VA. The first 30 days of work will be full-time on-site.
- Coordinate and conduct all Agency penetration testing on systems operated by and on behalf of NCUA, ensuring access to NCUA applications and infrastructure occurs only through NCUA-specified authentication methods and is limited to vetted personnel
- Develop, maintain, and update the Penetration Testing Concept of Operations (CONOPS) and Standard Operating Procedures (SOPs) in accordance with NIST guidance, applicable Federal regulations, and industry best practices
- Coordinate with NCUA prior to each assessment to determine the appropriate assessment model and identify the underlying technology to be tested
- Draft Rules of Engagement and test-specific penetration testing documentation for each engagement
- Perform a range of testing and detection activities - including red teaming, blue teaming, penetration testing, adversary emulation, purple teaming, and breach and attack simulation - to improve SOC operations and strengthen the Agency's overall defensive posture
- Meticulously document all findings and vulnerabilities identified during testing, including categorizing risk, evaluating potential impact, and prioritizing remediation based on severity; provide regular status updates to stakeholders to ensure transparency and timely action
- Simulate advanced persistent threat (APT) scenarios by emulating sophisticated adversary tactics, techniques, and procedures (TTPs) to evaluate system resilience, identify gaps in security posture, and inform enhanced protective measures
- Conduct red and blue team exercises in which the red team simulates attacks and the blue team detects and responds in real time; produce post-exercise reviews highlighting successful detections and areas for improvement
- Execute the full assessment lifecycle, including onboarding, active assessment of the target, findings development, triage, detailed reporting, and patch validation
- Draft and publish a report for each penetration test, including results, findings, and proposed remediation efforts where applicable
- Maintain overall tracking of penetration testing activities across engagements
- Integrate penetration testing with related security efforts, including vulnerability assessments, threat modeling, event detection evaluation, continuous monitoring tool verification, incident response, and incident reporting compliance
Requirements
- US Citizenship required
- Strong understanding of operating systems (Windows, Linux/Unix) and core networking protocols (TCP/IP, DNS, HTTP/S, SMB, etc.)
- Demonstrated ability to identify, validate, and exploit vulnerabilities across networks, systems, and applications
- Working knowledge of web application technologies and common vulnerability classes (OWASP Top 10: injection flaws, authentication/session weaknesses, access control issues, etc.)
- Proficiency with industry-standard penetration testing tools (e.g., Burp Suite, Metasploit, Nmap, Nessus, Cobalt Strike, or equivalent)
- Scripting/automation ability in one or more languages (Python, Bash, PowerShell) to develop custom tools or modify existing exploits
- Must hold one or more of the following certifications: OSCP, CEH, GPEN, GWAPT, PenTest+, eCPPT.
- Bachelor of Science in Computer Science, Information Technology, Information Security, Cybersecurity or related field
Minimum of 5 years of experience conducting, supporting the conduct of, or leading penetration tests, including:
- Planning and executing network, application, and infrastructure penetration tests against enterprise environments
- Performing reconnaissance, vulnerability identification, exploitation, and post-exploitation activities in accordance with an approved rules of engagement
- Developing and delivering findings reports that translate technical vulnerabilities into business risk and prioritized remediation guidance
- Strong written communication skills, with demonstrated ability to produce clear, well-organized findings reports for both technical and non-technical stakeholders
- Strong verbal communication skills to brief findings, risk ratings, and remediation recommendations to leads, system owners, or client stakeholders
- Strong problem-solving skills and ability to work independently or as part of a team under defined timelines
- Ability to exercise sound judgment and professionalism when operating within sensitive or production environments
Desirable Qualifications:- Experience supporting or leading engagements in a regulated or federal environment is a plus, particularly experience aligned with NIST SP 800-53, SP 800-115, and Risk Management Framework (RMF) processes
- Familiarity with wireless and social engineering testing methodologies is a plus
Clearance Requirement: Ability to obtain and maintain a Public Trust.
The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements.
Gunnison Consulting Group's total compensation package also includes bonus and profit-sharing opportunities, depending on company and employee performance. Available employee benefits include:
- 3 weeks of Personal Leave your first year
- 11 paid Holidays each year
- 5 days of Flexible Time Off each year for approved training or certifications (self-study is ineligible)
- 401(k) company match at 50% up to 10% of your salary
- Medical, Dental and Vision Insurance
- Life and Disability Insurance
- Public Transportation Subsidies
- Certifications and Training Allowance - Up to $5,000/year!
Salary Description
$125,000 - $145,000/year
