Job Type Contract Description Position Summary Performs blind and intelligent penetration testing against internet-facing assets - web applications, firewalls, remote access (VPN/RDP), and internet postings - for all 47 County departments, attempting to obtain confidential/sensitive data using real-world threat intelligence-based techniques while evading detection. Key Responsibilities • Conduct external network and web application penetration testing and vulnerability assessments per NIST SP 800-115 methodology. • Attempt to obtain ePHI, PII, financial data, and privileged communications from external sources without causing service disruption. • Document all findings with risk ratings, evidence, and remediation recommendations for the Assessment report. • Attempt to avoid detection and evade department response efforts during testing windows, as scoped. Requirements Required Qualifications • 4+ years of hands-on external network / web application penetration testing experience. • Proficiency with industry-standard tools (Burp Suite, Nmap, Metasploit, or equivalent). • Strong understanding of OWASP Top 10 and common network attack vectors. Preferred Qualifications • OSCP, GPEN, GWAPT, or CEH certification. • Experience testing government or healthcare-sector environments. Travel Fully remote; must remain within the continental United States.
Experience: 4 years required