Test Engineer Principal (Security)

Clearance Level Must Currently Possess:

Clearance Level Must Be Able to Obtain:

Job Family:

Job Description:

TEST ENGINEER PRINCIPAL (SECURITY)

Advance how our customers operate while you advance your career. Join GDIT a Test Engineer Principal and build an impactful career in enterprise IT, collaborating with people who are driven and resourceful like you

GDIT is seeking a senior-level Test Engineer to support the New York State Department of Health Medicaid Management Information System (MMIS) program. This role is a high-impact, senior individual contributor position within the Security Architecture team. You will design and execute security test plans across a diverse technical environment spanning a mixed estate: bespoke web applications, REST/SOAP APIs, batch and integration services, file-based interfaces, COTS systems, multi-account AWS, and Azure back-office infrastructure. You will break systems before adversaries can, automate repeatable testing processes, and influence secure engineering practices across eMedNY.

In this role, your responsibilities will be:

Security Testing Architecture

• Select and evaluate security testing tools aligned to technology stack, scope, and risk.
• Document tool selection requirements, assumptions and constraints to justify procurement and retain selection rationale.  
• Configure, validate, and maintain testing tools, ensuring safe and repeatable execution.
• Coordinate tool use access with developers, testers, and eMedNY Program Security.

Application Security Testing

• Review proposed bespoke application changes and architectural updates to determine security test scope.
• Develop comprehensive security test plans and test cases for bespoke applications and COTS components.
• Design test cases that thoroughly document prerequisites, expected results, evidence, and success criteria including authentication, authorization, input handling, data protection, and error handling.
• Coordinate bespoke applications test plans and test cases with development and functional testing teams.
• Execute test plans, producing detailed results with findings, impact, severity, and remediation guidance.
• Perform manual testing beyond automated scanning, including: business logic abuse, access control bypass, injection, session handling, data exposure
• Review source code and IaC for security defects; pair with engineers to reproduce, disposition and/or fix findings.
• Integrate SAST, DAST, SCA, and secrets scanning into GitLab CI pipelines; tune rules to keep signal high and noise low.

Cloud and infrastructure testing

• Assist in developing and executing AWS security test plans, analyzing IAM, VPC segmentation, exposed services, encryption, login, and privilege escalation paths.
• Validate AWS Security Hub and Config outputs; identify gaps between theoretical compliance and real posture.
• Test container, serverless, and managed-service configurations, including Bedrock and API gateway deployments.
• Conduct adversary-emulation exercises and document detection coverage.

Reporting and remediation

• Collaborate with development and architecture teams to triage and address findings.
• Track remediation to closure, perform re-tests and report security posture trends.
• Partner with Program Security to integrate results into Vulnerability Management lifecycle.
• Prepare regular, periodic reports on dispositions and remediation progress of findings.
• Write clear, actionable findings with reproducible steps, and consistent impact and severity ratings.

Bring your technology expertise and drive for innovation to GDIT. The Ethical Hacker/Penetration Tester Sr Principal must have:

• Education: Bachelor’s in Computer Science, information security, or a related field; or equivalent experience.

• Experience: 8+ years information security, with at least 5 years of hands-on application testing or offensive security work.

• Technical Skills:

• Demonstrated depth in web application and API testing.
• Experience testing systems under FedRAMP, HIPAA, or other regulated frameworks.
• Working knowledge of NIST 800-53 control families and evidence mapping.
• Proficiency in Python or similar scripting language for tooling and automation.
• Experience with security tools: Burp Suite Pro, OWASP ZAP, Nmap, Metasploit, Nessus/ Qualys, sqlmap; and cloud-specific tools:  Prowler, ScoutSuite, Pacu, CloudSploit.
• Experience running security tooling in CI/CD (GitLab or equivalent).

·         Role Requirements:

• Convert requirements and risks into actionable test cases and acceptance criteria.
• Healthcare payer, Medicaid, or other public-sector program experience.
• Obtain/maintain required NY State background checks.
  • Strong technical writing, and ability to communicate with non-technical stakeholders
  • Effective as an individual contributor, influencing through architecture guidance, reference implementations, and mentorship

• ·         Preferred Requirements:
  • OSCP, OSWE, GPEN, GWAPT, GCPN, or AWS Security Specialty.
  • Hands-on AWS security testing experience: IAM, VPC networking, KMS, CloudTrail, Security Hub, Config, and common misconfiguration classes.
  • Testing mainframe-adjacent systems: (MQ, file transfer, batch, terminal emulation).
  • LLM-based application testing: (prompt injection, agent misuse, data leakage).
  • Familiarity with Java, COBOL, or both at a read-the-code level.
  • Purple-team or detection-engineering experience with SIEM and cloud-native logging

·         Location: Hybrid if local to the Albany, NY area or 100% Remote

GDIT IS YOUR PLACE At GDIT,

the mission is our purpose, and our people are at the center of everything we do. ● Growth: AI-powered career tool that identifies career steps and learning opportunities

● Support: An internal mobility team focused on helping you achieve your career goals

● Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time off

● Flexibility: Full-flex work week to own your priorities at work and at home

● Community: Award-winning culture of innovation and a military-friendly workplace

OWN YOUR OPPORTUNITY

Explore a career at GDIT and you’ll find endless opportunities to grow alongside colleagues who share your ambition to deliver your best work.

Scheduled Weekly Hours:

Work Location:

Additional Work Locations:

gdit.com/tc.