Position Description :
The CGI Federal Offensive Security Group’s Application Security Engineering team supports a wide variety of enterprise DevSecOps processes within CGI Federal's full portfolio of Agile Release Trains.
We are seeking a professional Penetration Tester with a strong background in API testing of multiple proprietary and custom-coded applications throughout their SDLC.
Our clients include multiple Federal and State Agencies, local governments, and many US-based corporations. This role works with traditional, mobile, web, and enterprise applications across the full spectrum of business requirements including health, financial, communications, record creation, case management, and more.
This is a dynamic role that will allow the new member to grow their existing skills and develop new knowledge, skills, and abilities.
Your future duties and responsibilities :
This team member will :
- Perform manual and automated vulnerability assessments on API endpoints.
- Perform DAST and SAST application security testing techniques using automated tools and manual testing (i.e., Burp Suite, OWASP ZAP, WebInspect, HP Fortify, OWASP Dependency Checker).
- Create exploit proof of concepts and report vulnerabilities to applications PMs and developers.
- Identify application security weaknesses and write recommendations for preventing or fixing them.
- Serve as SME for multiple projects at the same time.
- Review code for common security vulnerabilities.
- Support and consult with product and development teams in the area of application security.
- Perform vulnerability scans on container environments.
- Assist team and clients to adapt security testing requirements into Continuous Integration / Continuous Deployment (CI / CD) pipeline(s).
- Provide specialized support to the CGI Federal Red Team as needed
Required qualifications to be successful in this role :
- 3+ years API security testing KSA and experience.
- 3+ years dynamic and static application penetration testing (DAST and SAST) of software in development.
- Familiarity with penetration testing tools and tradecraft within on-premises, cloud, and containerized software instances.
- Conversant and knowledgeable on cybersecurity best practices, the practices themselves, where to find the practices, and a willingness to employ the practices.
- Firm understanding and support of the principals of ethical hacking.
- Strong written and verbal skills. Must be able to express security finds to both technicians and non-technical project managers.
Desired qualifications / non-essential skills required :
- 2+ years on a Federal Agency’s penetration testing or red team.
- Experience with security testing for HIPPA compliance.
- Experience with security testing for financial sector compliance
- Expresses willingness to work in a team environment (meaning work together in real-time on an engagement or plan in-person or remotely).
- CI / CD security testing experience.
- Experience assessing and testing the security of containers and the application within them.
- Ņ+ years software development and testing (any language) or 5+ years defensive cyber operations for Federal clients.
- Demonstrated continuous learning such as recently updated personal Git repos, Hack The Box or TryHackMe dashboards showing recent activity, earned and maintained cybersecurity (either in general or tool-specific) certifications.
CGI is required by law in some jurisdictions to include a reasonable estimate of the compensation range for this role. The determination of this range includes various factors not limited to skill set, level, experience, relevant training, and license and certifications.
To support the ability to reward for merit-based performance, CGI typically does not hire individuals at or near the top of the range for their role.
Compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range for this role in the U.S. is $96,.00 - $,.00.
CGI Federal anticipates accepting applications for this position through Jul 15, .
At CGI we call our professionals members to reinforce that all who join our team are, as owners,
empowered to participate in the challenges and rewards that come from building a world-class company.
CGI’s benefits include :
- Competitive compensation
- Comprehensive insurance options
- Matching contributions through the (k) plan and the share purchase plan
- Paid time off for vacation, holidays, and sick time
- Paid maternity and parental leave
- Learning opportunities and tuition assistance
- Member assistance and wellness programs
Due to the nature of this government contract, US Citizenship is required.
CGIFederalJob
LI-SB12
Skills :
- Application Development
- Ethical Hacking
Jr Cyber Penetration Tester - Security Clearance Required
Perform and report on penetration testing of systems, including cloud, to satisfy the NIST 800-53 CA-8 security control and using methodologies that may include, NIST SP 800-115, Penetration Testing Execution Standard (PTES), and Information Systems Security Assessment Framework (ISSAF). The DSCM pr...
Cyber Security Engineer
The Senior Info Security Analyst will monitor the organization’s networks for any security breaches and investigate/mitigate any issues. Red Hat Enterprise Linux (RHEL) or Windows system administration. Minimum 7 years’ experience working in Info Security. Developed security standards and best pract...
ARPA H Sr Cyber Security Engineer
ARPA H Sr Cyber Security Engineer. Specifically for this listing, we are seeking a Cyber Security Engineer or a related field and 15+ years of experience. National EHR backup system, corruption possibilities, computer engineers. MS in Computer Science, Computer Engineering, Electrical Engineering or...
Cyber Security Engineer (SME)
Primary Responsibilities:Plan, implement, manage, monitor, and upgrade security measures and tools for the protections of information systems and networks and automate repeatable tasks in a consultative roleDesign, configure, implement, troubleshoot, and maintain all security platforms and their ass...
Sr. Cyber Security Engineer (ACAS)
Experience with privileged and elevated access with cybersecurity tools such as ForeScout, Palo Alto Firewalls, Splunk and Cribl, or DoD Endpoint Security Solution (ESS) formerly (HBSS). As a Sr Cyber Engineer and assured compliance, assessment, and solution (ACAS) SME on our team, you’ll work indiv...
Cyber Security Engineer – Principal; Cyber Engineer/SCRUM Master/DPM
Cyber Security Engineer – Principal; Cyber Engineer/SCRUM Master/DPM. Cyber Engineer Lead, serving as a Deputy Project Manager, to join our team in the Chantilly, VA, area. Manage the engineering, integration, and administration support required for successful delivery of capabilities and services t...
Cyber Security Engineer
The desired cyber security engineer to assist with the deployment, configuration, and administration of security software in a hybrid on prem and Azure GovCloud environment. We are hiring for a Security Engineer to join forces with a team supporting one of our Federal customers. Experience following...
Cyber Security Project Engineer
The Systems Engineer will provide program management and system engineering support for compliance with the Sponsor’s A&A process and provide for the appropriate documentation through the various facets of this process. Overview VTG is looking for a Cyber Security Project Engineer in McLean, VA What...
Senior Cyber Security Engineer
Have detailed knowledge of Intelligence Community Directives (ICDs), Agency Cyber Security Policy, and Agency Guidance related to cybersecurity. Investigate and analysis of all data sources, to include Internet, Intelligence Community reporting, security events, firewall logs, forensic hard-drive im...
Cyber Security Engineer
Cyber Security Engineers are responsible for IT security/vulnerability assessments and managing overall network security using network and security-related hardware and software. The Cyber Security Engineer will target, assess, exploit, and report risks and vulnerabilities of information systems to ...