Description
Security Specialist 3 - Senior Web Application Security / Penetration Testing Specialist The California Department of Motor Vehicles is seeking an exceptionally experienced Security Specialist 3 to support the DMV Information Security Services Branch in protecting high-profile, public-facing web applications and the sensitive information handled by DMV systems. This is a senior hands-on application security and penetration testing position, not a general cybersecurity analyst or security operations role. The Security Specialist 3 will perform security assessments and penetration testing against current DMV public-facing web applications and major application changes, identify and validate vulnerabilities, assign risk ratings, recommend remediation, verify mitigation effectiveness, assess security/privacy controls, and help establish standardized application-security assessment methodologies. The consultant will work closely with the DMV Chief Information Security Officer (CISO) and Information Security Office personnel. The individual will also help ensure DMV secure-coding standards align with California and federal security requirements, including SAM, SIMM, NIST and PCI, and will provide knowledge transfer and mentoring to DMV personnel. This role requires someone who can move comfortably between offensive security testing, regulatory compliance, risk assessment, secure software development, remediation validation, executive-quality reporting, and training.
What This Person Will Actually Do
Conduct comprehensive security assessments of current public-facing DMV web applications. Perform security assessments when major changes are made to public-facing DMV applications. Develop and execute web application penetration tests. Identify exploitable application vulnerabilities and security weaknesses. Validate findings to distinguish meaningful security risks from false positives. Assign appropriate risk ratings to identified vulnerabilities. Develop clear, actionable mitigation and remediation recommendations. Prepare formal assessment reports for the DMV CISO. Work with the DMV CISO and technical teams to validate vulnerabilities and proposed mitigation strategies. Retest vulnerabilities following remediation to determine whether risk has been reduced to an acceptable level. Develop a standardized methodology for assessing DMV web applications for vulnerabilities and risk. Review closed Plan of Action and Milestones (POAM) Security and Privacy control items and determine whether remediation is sufficient and effective. Develop standardized security and privacy control-assessment methodologies that satisfy State of California and NIST requirements. Review DMV secure-coding standards and related security documentation. Map SAM, SIMM, NIST and PCI security controls to secure-coding standards. Identify gaps between application-development practices and applicable security/control requirements. Develop and deliver in-person and self-paced training on secure coding and web-application-security best practices. Conduct knowledge-sharing and mentoring sessions with DMV personnel. Produce clear technical documentation and knowledge-transfer materials. These responsibilities are directly tied to Tasks 1-3 of the SOW and repeat under the optional extension as Tasks 4-6.
Mandatory Requirements - Do Not Submit Without These
Mandatory Certifications
The candidate must possess ALL THREE of the following certifications, and each must have been held valid for a minimum of five years:
CISSP - Certified Information Systems Security Professional PCI QSA - Payment Card Industry Qualified Security Assessor GWAPT - GIAC Web Application Penetration Tester The RFP explicitly requires copies of all three valid certifications.
Recruiter warning: A candidate with CISSP and GWAPT but no PCI QSA does not meet the stated requirement. A candidate who just earned one of these certifications also does not satisfy the stated five-year certification requirement.
Mandatory Experience
5+ years - NIST and FIPS Minimum five years of professional experience working with: National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) 5+ years - California SAM and SIMM Minimum five years working with: California State Administrative Manual (SAM) California Statewide Information Management Manual (SIMM) This makes prior California State Government cybersecurity experience extremely valuable and significantly narrows the target candidate population. 10+ years - Web Application Security Minimum ten years developing and executing: Web Application Assessments Web Application Penetration Testing This should be genuine hands-on experience, not simply oversight of penetration-testing vendors. 5+ years - Regulatory/Data Protection Minimum five years of experience with one or a combination of: PCI DSS IRS Publication 1075 State/local government financial-data protection ISO/IEC 27000 series 3+ years - Security Training Minimum three years developing both in-person and self-paced training covering: Secure coding standards Web application security best practices These are explicit mandatory qualifications in the DMV SOW. Highly Desirable Certifications
GCPN - GIAC Cloud Penetration Tester and/or GMOB - GIAC Mobile Device Security This matters because DMV can award up to 100 desirable-qualification points for Security Specialist 3 based on these certificati.