The Role
Perform authenticated and unauthenticated web application vulnerability scans and application security assessments (DAST/SAST). Analyze and validate scan results, prioritize and correlate vulnerabilities using CVSS and risk methodologies, provide remediation guidance, support integration of scanning into DevSecOps/CI/CD, and collaborate with development teams to promote secure-by-design practices across NIH applications.
Summary Generated by Built In
cFocus Software seeks a Application Scanning Analyst to join our program supporting the National Institutes of Health (NIH). This position is fully remote. This position requires a Public Trust or the ability to obtain a public trust clearance.
Qualifications:
Duties:
Qualifications:
- Public Trust Clearance
- B.S. Computer Science, Information Technology, or a related field
- 5+ years of experience performing application security assessments or web application vulnerability scanning.
- Experience conducting authenticated and unauthenticated web application security testing.
- Experience supporting enterprise vulnerability management programs.
- Experience interpreting application security findings and developing remediation guidance.
- Experience supporting Federal cybersecurity or large enterprise environments.
- Preferred certifications include: GWAPT, GWEB, CSSLP, OSWA, or CEH
Duties:
- Perform authenticated and unauthenticated web application vulnerability scans.
- Conduct application security assessments against internally developed and commercial applications.
- Perform Dynamic Application Security Testing (DAST) and support Static Application Security Testing (SAST) activities.
- Assess APIs, web services, and middleware for security vulnerabilities.
- Conduct application configuration reviews and identify security weaknesses.
- Perform recurring vulnerability scans in accordance with Government-defined schedules.
- Analyze application scan results to identify security vulnerabilities and misconfigurations.
- Validate scan findings to eliminate false positives.
- Prioritize vulnerabilities using risk-based methodologies, including CVSS scoring and exploitability.
- Correlate application vulnerabilities with infrastructure and network risks.
- Identify critical vulnerabilities requiring immediate remediation.
- Perform root cause analysis for recurring application security issues.
- Collaborate with software development teams to improve application security.
- Provide remediation recommendations aligned with secure coding practices.
- Assist developers with vulnerability mitigation strategies.
- Support integration of security scanning into DevSecOps and CI/CD pipelines.
- Recommend application security improvements throughout the software development lifecycle (SDLC).
- Promote secure-by-design principles across NIH application environments.
Skills Required
- Public Trust clearance or ability to obtain one
- B.S. in Computer Science, Information Technology, or related field
- 5+ years performing application security assessments or web application vulnerability scanning
- Experience conducting authenticated and unauthenticated web application security testing
- Experience supporting enterprise vulnerability management programs
- Experience interpreting application security findings and developing remediation guidance
- Experience supporting Federal cybersecurity or large enterprise environments
- Preferred certifications: GWAPT, GWEB, CSSLP, OSWA, or CEH
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Established in 2006, cFocus Software automates FedRAMP compliance and develops government chatbots for the Azure Government Cloud, Office 365, and SharePoint. cFocus Software is the exclusive vendor of ATO (Authority To Operate) as a Service™, which automates FedRAMP compliance for the Azure Government Cloud and Office 365. Contact Us for a demo of ATO as a Service™ or a FREE government chatbot proof of concept project today!
