Information Security Specialist

About the Role

Job Title: Security Specialist 1 – Web Application Penetration Testing

Location: Sacramento, CA (Hybrid)

Job Type: Contract

Work Arrangement: Hybrid

Job Summary We are seeking an experienced Security Specialist 1 with a strong background in web application security assessments, penetration testing, security compliance, and secure coding practices. The ideal candidate will have extensive experience conducting web application penetration tests, working with security frameworks and regulatory standards, and developing security training for technical teams. Candidates must meet the mandatory qualifications listed below and provide supporting documentation for the required certifications and education.

Responsibilities

• Conduct web application security assessments and penetration testing.
• Work with security frameworks and regulatory standards.
• Develop security training for technical teams.

Qualifications

• Bachelor's degree or higher in Computer Science, Information Technology, Cybersecurity, Information Systems, Computer Engineering, or a closely related technical field from an accredited college or university.
• A copy of the degree must be provided.

Required Skills

• Mandatory Qualifications

1. Required Certifications

• Candidates must possess all three of the following valid certifications, each held for a minimum of five years:
• Certified Information Systems Security Professional (CISSP)
• PCI Qualified Security Assessor (QSA)
• GIAC Web Application Penetration Tester (GWAPT)
• Copies of all three valid certifications must be provided.

2. Security Standards and Frameworks

• Minimum of five years of experience working with the National Institute of Standards and Technology (NIST) and Federal Information Processing Standards (FIPS).
• Minimum of five years of experience working with the California State Administrative Manual (SAM) and California Statewide Information Management Manual (SIMM).

3. Web Application Penetration Testing

• Minimum of ten years of experience developing and executing web application assessments and penetration testing.

4. Regulatory Compliance Experience

• Minimum of five years of experience working with at least one or a combination of the following:
• Payment Card Industry Data Security Standards (PCI DSS)
• Internal Revenue Service Publication 1075
• State or local government financial data protection
• ISO/IEC 27000 series standards

5. Security Training Development

• Minimum of three years of experience developing both in-person and self-paced training on secure coding standards and web application security best practices.

6. Education

• Bachelor's degree or higher in Computer Science, Information Technology, Cybersecurity, Information Systems, Computer Engineering, or a closely related technical field from an accredited college or university.
• A copy of the degree must be provided.

Preferred Skills

• Desirable Qualification
• A valid GIAC Cloud Penetration Tester (GCPN) or GIAC Mobile Device Security (GMOB) certification.
• A copy of the valid certification must be provided if applicable.