cFocus Software Incorporated · 16 hours ago
HHS - Penetration Tester
United States
Full-time
Remote
Senior Level
5+ years expcFocus Software seeks a Penetration Tester to join our program supporting the Department of Health and Human Services (HHS). This role involves planning, executing, and documenting penetration tests across various environments to identify vulnerabilities and assess security risks.
ChatbotGovernmentInformation TechnologySoftware
No H1B
Security Clearance RequiredU.S. Citizen Only
Responsibilities
Plan, execute, and document penetration tests against networks, systems, web applications, APIs, databases, and cloud environments
Conduct internal, external, authenticated, unauthenticated, and adversary-simulation testing activities
Perform exploitation, post-exploitation, and privilege escalation to demonstrate real-world risk
Validate vulnerability scan findings and identify false positives and chained attack paths
Conduct application penetration testing aligned with OWASP Top 10 and NIST guidance
Support red team and purple team exercises in coordination with SOC and Incident Response teams
Analyze attacker techniques using MITRE ATT&CK and document TTPs and attack paths
Develop detailed penetration test reports including executive summaries, risk ratings, and remediation guidance
Provide technical remediation guidance to system owners, engineers, developers, and ISSOs
Validate remediation effectiveness through retesting and evidence review
Support compliance testing requirements related to FISMA, RMF, and continuous monitoring
Maintain strict rules of engagement, authorization documentation, and testing approvals
Ensure testing activities comply with HHS, HRSA, and federal legal and ethical requirements
Qualification
Required
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field
Minimum 5–8 years of experience performing penetration testing or offensive security assessments
Hands-on experience testing enterprise networks, applications, and cloud environments
Strong knowledge of attack techniques, exploitation frameworks, and post-exploitation methods
Strong understanding of NIST SP 800-53, NIST SP 800-30, and vulnerability management processes
Excellent analytical, documentation, and communication skills
Ability to obtain a Public Trust clearance
Preferred
Experience with federal environments and vulnerability management programs
OSCP, GPEN, CEH, or GXPN
Company
cFocus Software Incorporated
cFocus Software automates FedRAMP compliance and develops government chatbots for the Azure Government Cloud, Office 365, and SharePoint.
11-50 employees
Funding
Current Stage
Early StageLeadership Team
Manisha Griesinger, MPH, MSc
Program Manager | U.S. EPA Office of the Chief Financial Officer
Company data provided by crunchbase