Qureos Mentor

Rividium

<div>RiVidium Inc. is seeking an experienced Vulnerability Assessment &amp; Penetration Testing Specialist ? Level III to serve the team for all Cybersecurity and Intelligence Enterprise Information Technology Services (CIEITS) program activities.
The Vulnerability Assessment &amp; Penetration Testing Specialist ? Level III serves as the senior technical expert responsible for planning, executing, and leading advanced penetration testing, vulnerability assessments, software assurance, and cyber supply chain risk management activities across the Department of Homeland Security (DHS) Intelligence Enterprise (DHS IE). This role performs comprehensive security assessments of enterprise networks, cloud environments, applications, operating systems, and Cross Domain Solutions (CDS) using industry-recognized methodologies and advanced manual testing techniques.
The specialist leverages frameworks such as MITRE ATT&amp;CK, OWASP, NIST, and industry best practices to identify vulnerabilities that may not be detected by automated tools. The position also supports software assurance initiatives through secure code reviews, application security testing, and Supply Chain Risk Management (SCRM) activities to strengthen the cybersecurity posture of DHS IE systems.
Working closely with Security Operations Center (SOC) personnel, Cybersecurity Engineers, Information System Security Officers (ISSOs), Information System Security Managers (ISSMs), developers, and Government stakeholders, the Vulnerability Assessment &amp; Penetration Testing Specialist provides expert recommendations to reduce enterprise cyber risk while ensuring compliance with Federal, DHS, and Intelligence Community (IC) cybersecurity requirements.
Key Responsibilities
<ul><li>Lead and conduct comprehensive penetration testing engagements for DHS Intelligence Enterprise systems, networks, applications, cloud environments, and infrastructure.</li>
<li>Perform penetration testing using industry-recognized methodologies, including:
<ul><li>MITRE ATT&amp;CK Framework</li>
<li>OWASP Web Security Testing Guide</li>
<li>NIST penetration testing guidance</li>
<li>PTES (Penetration Testing Execution Standard)</li>
</ul></li><li>Plan and execute all phases of penetration testing, including:
<ul><li>Pre-engagement planning</li>
<li>Rules of Engagement (ROE)</li>
<li>Threat intelligence gathering</li>
<li>Threat modeling</li>
<li>Vulnerability identification</li>
<li>Exploitation</li>
<li>Post-exploitation analysis</li>
<li>Reporting and remediation recommendations</li>
</ul></li><li>Utilize advanced manual testing techniques to identify vulnerabilities that are not detectable through automated scanning tools.</li>
<li>Perform network, web application, wireless, cloud, and infrastructure penetration testing using ethical hacking techniques while ensuring no disruption to production environments.</li>
<li>Validate Security Operations Center (SOC) detection and incident response capabilities through controlled adversary emulation and red team testing.</li>
<li>Assess logging, monitoring, detection, and response mechanisms to identify gaps in defensive capabilities.</li>
<li>Perform software assurance reviews by conducting security and compliance testing of software requests and applications prior to deployment.</li>
<li>Review Software Assurance Request Forms and provide technical adjudication and security recommendations.</li>
<li>Conduct vulnerability assessments of enterprise systems and deliver comprehensive Security Assessment Reports (SARs) and Vulnerability Assessment Reports (VARs) within established service-level agreements.</li>
<li>Perform Supply Chain Risk Management (SCRM) and Cyber Supply Chain Risk Management (C-SCRM) assessments for software, hardware, and third-party technologies supporting DHS IE.</li>
<li>Conduct secure source code reviews using both automated and manual analysis techniques to identify software vulnerabilities and coding weaknesses.</li>
<li>Utilize static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA) tools to evaluate software security.</li>
<li>Maintain the penetration testing toolkit, ensuring monthly software updates, quarterly configuration reviews, and compliance with approved security baselines.</li>
<li>Develop comprehensive penetration testing reports documenting:
<ul><li>Testing methodology</li>
<li>Attack paths</li>
<li>Exploited vulnerabilities</li>
<li>MITRE ATT&amp;CK mappings</li>
<li>Risk ratings</li>
<li>Technical findings</li>
<li>Executive summaries</li>
<li>Remediation recommendations</li>
</ul></li><li>Develop and maintain Standard Operating Procedures (SOPs) supporting penetration testing, software assurance, vulnerability assessment, and SCRM activities.</li>
<li>Collaborate with cybersecurity engineering, DevSecOps, cloud engineering, and system administration teams to remediate identified vulnerabilities.</li>
<li>Support cybersecurity audits, security assessments, authorization activities, and continuous monitoring initiatives.</li>
<li>Participate in cybersecurity working groups and provide technical guidance on emerging threats, offensive security techniques, and vulnerability management best practices.</li></ul> 

Minimum Qualifications
<ul><li>Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.</li>
<li>Minimum 7?10 years of experience performing penetration testing, vulnerability assessments, software assurance, and offensive cybersecurity activities within Federal Government or Intelligence Community environments.</li>
<li>Current Certified Ethical Hacker (CEH) certification.</li>
<li>Current Certified Information Systems Security Professional (CISSP) certification.</li>
<li>Expert knowledge of:
<ul><li>MITRE ATT&amp;CK Framework</li>
<li>OWASP Testing Methodology</li>
<li>OWASP Top 10</li>
<li>NIST Cybersecurity Framework</li>
<li>Penetration Testing Execution Standard (PTES)</li>
</ul></li><li>Demonstrated experience with penetration testing and vulnerability assessment tools such as:
<ul><li>Burp Suite Professional</li>
<li>Nessus / ACAS</li>
<li>Nmap</li>
<li>Metasploit Framework</li>
<li>Wireshark</li>
<li>Kali Linux</li>
<li>WebInspect</li>
<li>Nikto</li>
<li>Other industry-standard offensive security tools</li>
</ul></li><li>Experience performing software assurance using:
<ul><li>SonarQube</li>
<li>GitLab Security</li>
<li>Static Application Security Testing (SAST)</li>
<li>Dynamic Application Security Testing (DAST)</li>
<li>Software Composition Analysis (SCA)</li>
</ul></li><li>Minimum 2 years of experience in each of the following:
<ul><li>Software Assurance</li>
<li>Penetration Testing</li>
<li>Vulnerability Assessment</li>
<li>Patch Management</li>
<li>Secure Cloud and Hybrid Cloud Security Engineering</li>
</ul></li><li>Experience performing secure code reviews and identifying application security vulnerabilities.</li>
<li>Bachelor's degree in Cybersecurity, Computer Science, Software Engineering, Information Systems, or a related technical discipline.</li></ul> 

Preferred Qualifications
<ul><li>Offensive Security Certified Professional (OSCP) certification.</li>
<li>GIAC Penetration Tester (GPEN) certification.</li>
<li>Experience conducting penetration testing of Cross Domain Solutions (CDS) and classified information systems.</li>
<li>Experience supporting DHS Intelligence &amp; Analysis (I&amp;A) or other Intelligence Community cybersecurity programs.</li>
<li>Familiarity with:
<ul><li>DISA Security Technical Implementation Guides (STIGs)</li>
<li>Container security (Docker, Kubernetes)</li>
<li>Kubernetes security</li>
<li>Serverless application security</li>
<li>Secure DevSecOps pipelines</li>
</ul></li><li>Experience supporting Cloud Service Provider (AWS, Azure, or Google Cloud) penetration testing and cloud-native security assessments.</li>
<li>Experience performing adversary emulation, purple team, or red team exercises.</li>
<li>Familiarity with NIST SP 800-161 Cyber Supply Chain Risk Management (C-SCRM) guidance.</li></ul> 

Required Certifications
The following current certifications are required:
<ul><li>Certified Ethical Hacker (CEH)</li>
<li>Certified Information Systems Security Professional (CISSP)</li>
</ul>
Preferred certifications include:
<ul><li>Offensive Security Certified Professional (OSCP)</li>
<li>GIAC Penetration Tester (GPEN)</li>
</ul>
Clearance Requirement
Active Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance Required</div>

Vulnerability Assessment & Penetration Testing Specialist ? Level III

<div>RiVidium Inc. is seeking a Vulnerability Assessment Analyst who will perform assessments of systems and networks within the NE or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. Measures effectiveness of defense-in-depth architecture against known vulnerabilities.
TASKS:
<ul><li>Analyze organization's cyber defense policies and configurations and evaluate compliance with regulations and organizational directives.</li>
<li>Conduct and/or support authorized penetration testing on enterprise network assets.</li>
<li>Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense software and hardware) to support cyber defense audit missions.</li>
<li>Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing.</li>
<li>Prepare audit reports that identify technical and procedural findings, and provide recommended remediation strategies/solutions.</li>
<li>Conduct required reviews as appropriate within environment (e.g., Technical Surveillance, Countermeasure Reviews [TSCM], TEMPEST countermeasure reviews).</li>
<li>Perform technical (evaluation of technology) and nontechnical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications).</li>
<li>Make recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes).</li>
</ul>
ABILITIES:
<ul><li>Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.</li>
<li>Skill in assessing the robustness of security systems and designs.</li>
<li>Skill in detecting host and network based intrusions via intrusion detection technologies (e.g., Snort).</li>
<li>Skill in mimicking threat behaviors.</li>
<li>Skill in the use of penetration testing tools and techniques.</li>
<li>Skill in the use of social engineering techniques. (e.g., phishing, baiting, tailgating, etc.).</li>
<li>Skill in using network analysis tools to identify vulnerabilities. (e.g., fuzzing, nmap, etc.).</li>
<li>Skill in reviewing logs to identify evidence of past intrusions.</li>
<li>Skill in conducting application vulnerability assessments.</li>
<li>Skill in performing impact/risk assessments.</li>
<li>Skill to develop insights about the context of an organization?s threat environment</li>
<li>Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).</li>
</ul>
Requirements:
<ul><li>Bachelor degree or higher from an accredited college or university
<ul><li>Prefer an accredited Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, or Computer Engineering degree; or a degree in a Mathematics or Engineering field.</li>
</ul></li><li>IAT/ IAM Level 2</li>
<li>Active TS/SCI clearence</li></ul></div>

Vulnerability Assessment Analyst - Intermediate

<div>RiVidium Inc. is seeking a Software Developer to develop, create, maintain, and write/code new (or modifies existing) computer applications, software, or specialized utility programs.
Tasks:
<ul><li>Automate the Risk Management Framework (RMF) process to the fullest extent.</li>
<li>Develop custom tools and dashboards, including executive data visualizations in Tableau, to support and enhance system continuous monitoring efforts.</li>
<li>Lead intermediate-level developers to success.</li>
<li>Act as a customer-facing representative engaging with key stakeholders.</li>
<li>Serve as a Frontend Designer to develop and design application interfaces using HTML, CSS, JavaScript, and React.</li>
<li>Write, develop, and deploy robust code across the full stack, utilizing languages such as Python.</li>
<li>Develop, integrate, and maintain databases to support backend application requirements.</li>
<li>Communicate effectively with all levels of personnel, both technical and non-technical.</li>
<li>Analyze information to determine, recommend, and plan the development of a new application or modification of an existing application.</li>
<li>Analyze user needs and software requirements to determine feasibility of design within time and cost constraints.</li>
<li>Apply coding and testing standards, apply security testing tools including &quot;'fuzzing&quot; static-analysis code scanning tools, and conduct code reviews.</li>
<li>Apply secure code documentation.</li>
<li>Capture security controls used during the requirements phase to integrate security within the process, to identify key security objectives, and to maximize software security while minimizing disruption to plans and schedules.</li>
<li>Compile and write documentation of program development and subsequent revisions, inserting comments in the coded instructions so others can understand the program.</li>
<li>Confer with systems analysts, engineers, programmers, and others to design application and to obtain information on project limitations and capabilities, performance requirements, and interfaces.</li>
<li>Consult with engineering staff to evaluate interface between hardware and software.</li>
<li>Correct errors by making appropriate changes and rechecking the program to ensure that desired results are produced.</li>
<li>Design, develop, and modify software systems, using scientific analysis and mathematical models to predict and measure outcome and consequences of design.</li>
<li>Develop secure code and error handling.</li>
<li>Evaluate factors such as reporting formats required, cost constraints, and need for security restrictions to determine hardware configuration.</li>
<li>Identify basic common coding flaws at a high level.</li></ul> 

Abilities:
<ul><li>Ability to demonstrate a deep knowledge of software development and showcase a high level of understanding.</li>
<li>Ability to design and develop continuous monitoring tools and dashboards, analyzing and visualizing complex data using Tableau and other technologies.</li>
<li>Ability to operate effectively as a Full Stack Developer using Python, HTML, CSS, and JavaScript.</li>
<li>Ability to build interactive user interfaces using React and design robust database structures.</li>
<li>Ability to understand and apply the Risk Management Framework (RMF).</li>
<li>Ability to tailor code analysis for application-specific concerns.</li>
<li>Ability to use and understand complex mathematical concepts (e.g., discrete math).</li>
<li>Ability to develop secure software according to secure software deployment methodologies, tools, and practices.</li>
<li>Ability to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).</li>
<li>Ability to identify critical infrastructure systems with information communication technology that were designed without system security considerations.</li> 
</ul>Requirements:
<ul><li>Must possess established Risk Management Framework (RMF) knowledge upon hire.</li>
<li>Demonstrated experience with Python, HTML, CSS, JavaScript, and React.</li>
<li>Demonstrated experience working with databases, building visualizations in Tableau, and developing tools for continuous monitoring.</li>
<li>Bachelor degree or higher from an accredited college or university</li>
<li>Prefer an accredited Computer Science, Cyber Security, Information Technology, Software Engineering, Information Systems, or Computer Engineering degree; or a degree in a Mathematics or Engineering field.</li>
</ul>
Certifications: IAT Level 2
Active TS/SCI clearance required with the ability to get a CI Poly</div>

Software Developer - Intermediate

Join Rividium and explore 3   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Rividium

About Company

Vulnerability Assessment & Penetration Testing Specialist ? Level III

Vulnerability Assessment Analyst - Intermediate

Software Developer - Intermediate