Pen Tester

Title: Pen Tester

• Penetration testing engagement for the County’s MRA web application.
• Sr. Pen Tester would be great
• CTC is DOE
• Strong communication skills
  

Resource shall perform the following Security Services for comprehensive penetration testing on the MRA application suite:
1.1. Resource shall conduct intelligence gathering Services that includes an environment readiness check, a passive and active reconnaissance, fingerprinting, and tech-stack mapping.1.2. Resource shall conduct threat modeling by identifying attack surfaces and business logic entry points.1.3. Resource Shall Conduct Vulnerability Analysis Services To Identify And Assess Unknown Security Weaknesses That Might Be Present In The MRA Application As Follows1.3.1. Automated and manual vulnerability detection (Open Worldwide Application Security Project (“OWASP”), Common Vulnerabilities and Exposures (“CVES”), insecure patterns)1.3.2. Conduct black-box testing to be performed without access to application credentials in order to simulate an external attacker attempting to breach or exploit public-facing functionalities.1.4. Resource shall conduct manual exploitation of found vulnerabilities to validate findings, avoiding Denial of Service (“DoS”) or data loss.1.5. Resource shall conduct a post-exploitation assessment by performing a lateral access analysis.1.6. Resource Will Provide The Following Reporting Services1.6.1. Documentation of findings of vulnerabilities, evidence of vulnerabilities, and mitigation strategies.1.6.2. Provide a Penetration Testing Report, a Vulnerability Tracker, and a Retest Report as needed.1.7. Resource Shall Perform The Following Retesting Services, That Are Applicable Only To Vulnerabilities Rated Medium, High, Or Critical, As Needed1.7.1. Conduct one round of retesting within ninety (“90”) calendar days of initial testing.