NIH - Application Scanning Analyst

• Perform authenticated and unauthenticated web application vulnerability scans.
• Conduct application security assessments against internally developed and commercial applications.
• Perform Dynamic Application Security Testing (DAST) and support Static Application Security Testing (SAST) activities.
• Assess APIs, web services, and middleware for security vulnerabilities.
• Conduct application configuration reviews and identify security weaknesses.
• Perform recurring vulnerability scans in accordance with Government-defined schedules.
• Analyze application scan results to identify security vulnerabilities and misconfigurations.
• Validate scan findings to eliminate false positives.
• Prioritize vulnerabilities using risk-based methodologies, including CVSS scoring and exploitability.
• Correlate application vulnerabilities with infrastructure and network risks.
• Identify critical vulnerabilities requiring immediate remediation.
• Perform root cause analysis for recurring application security issues.
• Collaborate with software development teams to improve application security.
• Provide remediation recommendations aligned with secure coding practices.
• Assist developers with vulnerability mitigation strategies.
• Support integration of security scanning into DevSecOps and CI/CD pipelines.
• Recommend application security improvements throughout the software development lifecycle (SDLC).
• Promote secure-by-design principles across NIH application environments.

• Public Trust Clearance
• B.S. Computer Science, Information Technology, or a related field
• 5+ years of experience performing application security assessments or web application vulnerability scanning.
• Experience conducting authenticated and unauthenticated web application security testing.
• Experience supporting enterprise vulnerability management programs.
• Experience interpreting application security findings and developing remediation guidance.
• Experience supporting Federal cybersecurity or large enterprise environments.
• Preferred certifications include: GWAPT, GWEB, CSSLP, OSWA, or CEH

Invitation for Job Applicants to Self-Identify as a U.S. Veteran

• A “disabled veteran” is one of the following:
• a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or
• a person who was discharged or released from active duty because of a service-connected disability.
• A “recently separated veteran” means any veteran during the three-year period beginning on the date of such veteran’s discharge or release from active duty in the U.S. military, ground, naval, or air service.
• An “active duty wartime or campaign badge veteran” means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.
• An “Armed forces service medal veteran” means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.