HHS - Penetration Tester

cFocus Software seeks a Penetration Tester to join our program supporting the Department of Health and Human Services (HHS) This position is remote. This position requires the ability a Public Trust clearance. Qualifications: • Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field. • Minimum 5–8 years of experience performing penetration testing or offensive security assessments. • Hands-on experience testing enterprise networks, applications, and cloud environments. • Strong knowledge of attack techniques, exploitation frameworks, and post-exploitation methods. • Experience with federal environments and vulnerability management programs preferred. • Strong understanding of NIST SP 800-53, NIST SP 800-30, and vulnerability management processes. • Excellent analytical, documentation, and communication skills. • OSCP, GPEN, CEH, or GXPN preferred. Duties: • Plan, execute, and document penetration tests against networks, systems, web applications, APIs, databases, and cloud environments. • Conduct internal, external, authenticated, unauthenticated, and adversary-simulation testing activities. • Perform exploitation, post-exploitation, and privilege escalation to demonstrate real-world risk. • Validate vulnerability scan findings and identify false positives and chained attack paths. • Conduct application penetration testing aligned with OWASP Top 10 and NIST guidance. • Support red team and purple team exercises in coordination with SOC and Incident Response teams. • Analyze attacker techniques using MITRE ATT&CK and document TTPs and attack paths. • Develop detailed penetration test reports including executive summaries, risk ratings, and remediation guidance. • Provide technical remediation guidance to system owners, engineers, developers, and ISSOs. • Validate remediation effectiveness through retesting and evidence review. • Support compliance testing requirements related to FISMA, RMF, and continuous monitoring. • Maintain strict rules of engagement, authorization documentation, and testing approvals. • Ensure testing activities comply with HHS, HRSA, and federal legal and ethical requirements. Apply tot his job Apply To this Job