IT Security & Compliance Specialist II

Agency
Division
Job Classification Title
IT Security & Compliance Specialist II (NS)
Position Number
Grade
DT10
About Us
North Carolina State Government is one of the state’s largest employers, with over 76,000 employees all working toward a common goal: a safer and stronger North Carolina. We are a large organization comprised of various agencies, offices, and universities, each providing important public services.
Eligible state employees are entitled to comprehensive benefits, including a variety of leave options, professional development opportunities, insurance, and more. To learn more about the benefits of being a North Carolina state employee, visit the N.C. Office of State Human Resources' website.
Permanent, temporary, and time-limited state government jobs can be found from the mountains to the coast. Find your next opportunity today!
Description of Work
The Application Security Penetration tester is responsible for identifying, analyzing, and mitigating vulnerabilities in software applications and APIs throughout the development lifecycle. This role collaborates closely with development and infrastructure teams to integrate secure coding practices and ensure the security of application from design through deployment.
The Application Penetration Tester is responsible to perform deep, manual and automated security assessments of NCDHHS applications. This role goes Beyond automated scanning- you will chain vulnerabilities, bypass controls, and emulate real adversary behavior across web apps, APIs, and mobile platforms.
Knowledge Skills and Abilities/Management Preferences
Salary Grade Range: $87,617.00 - $117,000.00Recruitment Range: $87,617.00 - $117,000.00
Candidates now meet the minimum qualifications of a position if they meet the minimum education and experience listed on the vacancy announcement.
The Knowledge, Skills, and Abilities (KSAs)/ Management Preferences are not required. Applicants who possess the following skills are preferred:
Hands-on experience performing manual penetration testing of web applications, REST and GraphQL APIs, and mobile applications, including static application security testing (SAST), dynamic application security testing (DAST), and threat modeling.
Skilled in identifying, exploiting, validating, and documenting security vulnerabilities, including SQL Injection (SQLi), Cross-Site Scripting (XSS), Server Side Request Forgery (SSRF), authentication and authorization flaws.
Proficient in conduction both manual and automated security assessment using industry-standard tools such as burp suite, OWASP ZAP, Nmap, Metasploit, Nessus, Snyk, Veracode and Checkmarx.
Experience in collaborating with software developers to triage, prioritize, and remediate security findings, while working closely with DevOps and engineering teams to ensure secure application design, configuration, and deployment.
Assisted in integrating security controls, automated testing, and vulnerability scanning into CI/CD pipelines to secure software development practices and DevSecOps initiatives.
Produced Comprehensive Technical assessment reports containing detailed proof- of-concept (PoC) Exploits, reproducible attack scenarios.
The Posting Will Close At 11:59 P.M. The Night Before The End Date This Position Is Funded In Part Through Federal Funds. This Role Is Eligible To Be Hybrid And Requires Onsite Reporting Located Within Raleigh, NC
About the NC DHHS Information Technology Division:
In collaboration with our partners, the North Carolina Department of Health and Human Services (DHHS) protects the health and safety of all North Carolinians and provides essential health and human services. The IT division (ITD) is one of the divisions that report to the Operational Excellence portfolio. The ITD division comprises four sections: Implementation and Operations, Strategy and Workforce, Enterprise Technology, and Vendor and Finance. ITD offers the following services but not limited to implementations, operations, project/portfolio management, infrastructure, consulting, business division liaison, digital transformation, IT strategy, enterprise technology, IT contract and vendor management, and data office services.
Compensation and Benefits:
The State of North Carolina offers excellent comprehensive benefits. Employees can participate in health insurance options, standard and supplemental retirement plans, and the NCFlex program (numerous high-quality, low-cost benefits on a pre-tax basis). Employees also receive paid vacation, sick, and community service leave. In addition, paid parental leave is available to eligible employees. Visit the website for State Benefits.
Supplemental Contact Information
The North Carolina Department of Health and Human Services (DHHS) is an Equal Opportunity Employer that embraces an Employment First philosophy, which consists of complying with all federal laws, state laws, and Executive Orders. We are committed to reviewing requests for reasonable accommodation at any time during the hiring process or while on the job. For more information about DHHS: https://www.ncdhhs.gov/.
DHHS uses the Merit-Based Recruitment and Selection Plan to fill positions subject to the State Human Resources Act with the most qualified individuals. Hiring salary will be based on relevant qualifications, internal equity, and budgetary considerations pertinent to the advertised position.
In accordance with the Governor’s Executive Order 303, our agency supports second-chance employment for individuals who were previously incarcerated or justice-involved. We invite all potential applicants to apply for positions for which they may be qualified.
Application Process
Be sure to complete the application in its entirety. Resumes will not be accepted in lieu of completing this application.
Information should be provided in the appropriate areas, to include the following: Education, including high school and all degrees obtained, Work Experience, and Certificates & Licenses. It is critical to our screening and salary determination process that applications contain comprehensive candidate information.
Answers to Supplemental Questions are not a substitute for providing all relevant information within the body of your application. To receive credit for the supplemental questions, you must provide supporting information within the "Work Experience" section of the application to support your answers.
If multiple applications are submitted to an individual posting, only the most recent application received prior to the closing date will be accepted. Applications must be submitted by 11:59 PM on the closing date.
Applicants may be subject to a criminal background check. All candidates selected for positions considered "Positions of Trust" will be subject to a criminal background check.
Due to the volume of applications received, we are unable to provide information regarding the status of your application over the phone. To check the status of your application, please log in to your account. Upon the closing date, applications are "Under Review" and will be screened by Human Resources for qualified applicants. The hiring process may take several weeks.
Degrees must be received from appropriately accredited institutions. Transcripts and degree evaluations may be uploaded with your application. The State of North Carolina/Office of State Human Resources uses the National Association of Credential Evaluation Services (NACES) as a referral resource for applicants who need to have their credentials certifi