Job Description: Senior .NET Architect / Penetration Testing Engineer
Client: South Carolina Department of Revenue (SCDOR)
Location: 300 A Outlet Point Blvd, Columbia, SC 29210
Work Arrangement: Onsite
Position Overview
The South Carolina Department of Revenue (SCDOR) is seeking an experienced Senior .NET Architect / Penetration Testing Engineer to design, develop, secure, test, and maintain enterprise-level applications within a highly secured, multi-firewall environment.
The ideal candidate will have extensive experience in C#, .NET development, full-stack MVC web applications, penetration testing, application security, and state government projects. This role requires strong architectural design capabilities, hands-on development expertise, and the ability to identify vulnerabilities, implement remediation strategies, and ensure compliance with security standards.
The consultant will collaborate with business stakeholders, application developers, systems analysts, database administrators, and infrastructure teams to deliver secure, scalable, high-performance, and maintainable enterprise solutions.
Key Responsibilities
- Application Architecture and Development
- Design, develop, and maintain enterprise-level applications using C#, .NET, and MVC architecture.
- Develop web, desktop, and console applications using C# and .NET 10.
- Build scalable, secure, and maintainable application architecture frameworks.
- Design application components, services, workflows, and business rules based on business and technical requirements.
- Develop full-stack MVC web applications and integrate enterprise systems and services.
- Create technical specifications, architectural models, class diagrams, interaction diagrams, component diagrams, and deployment diagrams.
- Recommend appropriate development tools, technologies, methodologies, and architectural approaches.
- Penetration Testing and Application Security
- Conduct penetration testing and security assessments of enterprise applications, systems, and infrastructure.
- Develop penetration testing tools and automation solutions using C# and .NET 10.
- Identify application vulnerabilities, security weaknesses, and potential attack vectors.
- Perform vulnerability analysis, risk assessment, remediation, and security validation.
- Utilize open-source and enterprise penetration testing tools to evaluate application security.
- Prepare comprehensive penetration testing reports documenting findings, risks, remediation recommendations, and validation results.
- Implement application hardening and data protection measures for secure server deployments.
- Provide technical guidance to development and infrastructure teams on vulnerability remediation.
- Security Compliance and Infrastructure
- Design and deploy applications in highly secured, multi-firewall environments aligned with applicable DISA STIG requirements.
- Support security implementations and audits involving PCI DSS, NIST standards, and IRS Publication 1075, as applicable.
- Collaborate with network administrators, database administrators, and infrastructure teams to ensure secure end-to-end system design.
- Support firewall and load balancer configurations and troubleshoot application connectivity issues.
- Develop automated Just-in-Time Provisioning (JITP) solutions for user onboarding and offboarding.
- Implement Active Directory integration and identity management functionality.
- Follow secure software development life cycle (SSDLC) practices and enterprise security policies.
- Testing and Software Quality Assurance
- Perform application testing, debugging, and security validation before production deployment.
- Support User Acceptance Testing (UAT) and resolve reported defects.
- Review application development activities to ensure compliance with established standards and architectural guidelines.
- Conduct structured reviews throughout the software development life cycle.
- Develop workarounds and implement corrective actions to resolve technical issues.
- Document test results, identified defects, security findings, and remediation activities.
- Database Management and Business Continuity
- Design, develop, and maintain secure database architectures and data access components.
- Support database security, performance optimization, and administration.
- Implement business continuity and disaster recovery strategies for enterprise applications and infrastructure.
- Support server and software upgrades, system maintenance, and operational improvements.
- Contribute to system stability, availability, performance monitoring, and production support.
- Documentation and Stakeholder Collaboration
- Prepare and maintain architecture documents, technical specifications, deployment plans, and operational support procedures.
- Communicate project progress, technical risks, issues, and recommendations to management and business stakeholders.
- Collaborate with development teams, infrastructure specialists, security professionals, and business users.
- Provide technical leadership, mentoring, and architectural guidance to application and systems analysts.
- Manage multiple priorities, respond to support tickets, and ensure timely issue resolution.
- Identify opportunities for process improvement and promote secure development practices.
Required Qualifications
- 11+ years of experience in C# and .NET application development.
- 11+ years of experience in penetration testing and application security.
- 10+ years of experience working on state government projects.
- 11+ years of experience in full-stack MVC web application development.
- Strong experience designing, developing, testing, and deploying enterprise applications.
- Hands-on experience with application security, vulnerability assessment, and remediation.
- Experience developing secure applications in complex, multi-firewall environments.
- Strong understanding of software architecture, secure coding practices, and SSDLC.
- Excellent technical documentation, analytical, communication, and problem-solving skills.
- Ability to work independently and collaboratively with technical teams and business stakeholders.
Preferred Qualifications
- Experience with PCI DSS, NIST security standards, and IRS Publication 1075 (Pub. 1075) implementations or audits.
- Experience implementing and validating DISA STIG security requirements.
- Experience with firewalls, load balancers, and secured server infrastructure.
- Strong background in vulnerability management and security remediation.
- 11+ years of experience in secure database design and administration.
- 11+ years of experience in Active Directory programming and integration.
- 11+ years of experience in business continuity planning and disaster recovery.
- Experience with Azure DevOps for source control, build pipelines, release management, and CI/CD.
- Experience with automated Just-in-Time Provisioning (JITP) and identity lifecycle management.
- Knowledge of service-oriented architecture (SOA), workflow engines, and business rules engines.
Education and Certifications
Required Education
- Bachelor's degree in Information Technology, Computer Science, Information Systems, or a related field.
Preferred Certifications
- Penetration testing or ethical hacking certifications.
- Microsoft or Azure certifications.
- CompTIA Security+ certification.
