Penetration Testing - Mid

ECS is seeking a Penetration Testing - Mid to work in our Suitland, MD office.  

Job Description:

• Identify threat tactics, methodologies, gaps, and shortfalls.
• Identify and direct the remediation of technical problems encountered during testing and implementation of new systems (e.g., identify and find work-arounds for communication protocols that are not interoperable).
• Identify security implications and apply methodologies within centralized and decentralized environments across the enterprise’s computer systems in software development.
• Identify security issues around steady state operation and management of software and incorporate security measures that must be taken when a product reaches its end of life.
• Identify, assess, and recommend cybersecurity or cybersecurity-enabled products for use within a system and ensure that recommended products are in compliance with organization's evaluation and validation requirements.
• Identify, collect, and seize documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents, investigations, and operations.
• Maintain baseline system security according to organizational policies.
• Maintain database management systems software.
• Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense software and hardware) to support cyber defense audit missions.
• Manage threat or target analysis of cyber defense information and production of threat information within the enterprise.
• Monitor and evaluate a system's compliance with information technology (IT) security, resilience, and dependability requirements.
• Monitor and evaluate the effectiveness of the enterprise's cybersecurity safeguards to ensure that they provide the intended level of protection.
• Verify stability, interoperability, portability, and/or scalability of system architecture.
• Work with stakeholders to resolve computer security incidents and vulnerability compliance

Required Skills:

• Identify threat tactics, methodologies, gaps, and shortfalls.
• Identify and direct the remediation of technical problems encountered during testing and implementation of new systems (e.g., identify and find work-arounds for communication protocols that are not interoperable).
• Identify security implications and apply methodologies within centralized and decentralized environments across the enterprise’s computer systems in software development.
• Identify security issues around steady state operation and management of software and incorporate security measures that must be taken when a product reaches its end of life.
• Identify, assess, and recommend cybersecurity or cybersecurity-enabled products for use within a system and ensure that recommended products are in compliance with organization's evaluation and validation requirements.
• Identify, collect, and seize documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents, investigations, and operations.
• Maintain baseline system security according to organizational policies.
• Maintain database management systems software.
• Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense software and hardware) to support cyber defense audit missions.
• Manage threat or target analysis of cyber defense information and production of threat information within the enterprise.
• Monitor and evaluate a system's compliance with information technology (IT) security, resilience, and dependability requirements.
• Monitor and evaluate the effectiveness of the enterprise's cybersecurity safeguards to ensure that they provide the intended level of protection.
• Verify stability, interoperability, portability, and/or scalability of system architecture.
• Work with stakeholders to resolve computer security incidents and vulnerability compliance.
• Bachelor's degree

Desired Skills:

• Experience conducting vulnerability scans and recognizing vulnerabilities in security systems.
• Skill in detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort).
• Skill in determining an appropriate level of test rigor for a given system.
• Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.
• Developing data dictionaries, data models, operations-based testing scenarios, security system access controls.
• Skill in mimicking threat behaviors, optimizing database performance, and performing packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
• Experience identifying, modifying, and manipulating applicable system components within Windows, Unix, or Linux (e.g., passwords, user accounts, files).
• Collecting, processing, packaging, transporting, and storing electronic evidence to avoid alteration, loss, physical damage, or destruction of data.
• Setting up a forensic workstation and forensic tool suites (e.g., EnCase, Sleuthkit, FTK).
• Analyzing anomalous code as malicious or benign, volatile data.
• Interpreting results of debugger to ascertain tactics, techniques, and procedures.
• Skill in Regression Analysis (e.g., Hierarchical Stepwise, Generalized Linear Model, Ordinary Least Squares, Tree-Based Methods, Logistic).

ECS is an equal opportunity employer and does not discriminate or allow discrimination on the basis of race, color, religion, gender, age, national origin, citizenship, disability, veteran status or any other classification protected by federal, state, or local law. ECS promotes affirmative action for minorities, women, disabled persons, and veterans.

ECS is a leading mid-sized provider of technology services to the United States Federal Government. We are focused on people, values and purpose. Every day, our 3000 employees focus on providing their technical talent to support the Federal Agencies and Departments of the US Government to serve, protect and defend the American People.