Position Overview
SGS-Penumbra is seeking a Junior Security Evaluator to support the testing and validation of cryptographic modules under the FIPS 140-3 Cryptographic Module Validation Program (CMVP). This position is ideal for an early-career technical professional interested in cybersecurity, cryptography, and security compliance.
The successful candidate will work alongside experienced evaluators to assess hardware, software, and firmware products against FIPS 140-3 requirements, while developing expertise in NIST standards, cryptographic testing, and security evaluations.
Key Responsibilities
FIPS Evaluation Activities
- Assist with the development and execution of FIPS 140-3 test plans in accordance with CMVP requirements.
- Review cryptographic module documentation, including security policies, design documentation, finite state models, and vendor evidence packages.
- Perform hands-on testing of cryptographic modules, including operational testing, physical security testing, and algorithm validation activities.
- Conduct Cryptographic Algorithm Validation Program (CAVP) testing using NIST-approved test methodologies and vectors.
- Document test procedures, test results, observations, and findings in accordance with laboratory quality procedures.
- Support preparation of validation reports and submission packages for CMVP review.
Physical Security Testing
- Perform physical security assessments of cryptographic modules in accordance with applicable FIPS 140-3 security level requirements.
- Evaluate enclosure construction, tamper evidence mechanisms, tamper response features, and other physical security controls.
- Assist in documenting physical security findings and test results.
Customer and Project Support
- Serve as a day-to-day technical point of contact for assigned customer projects.
- Coordinate evidence requests, documentation updates, and technical questions with customers.
- Provide project status updates and communicate risks, issues, and schedule impacts to senior staff.
- Track assigned project milestones and deliverables to support successful project completion.
Professional Development
- Develop working knowledge of FIPS 140-3, the NIST SP 800-140 series, CMVP implementation guidance, and related validation requirements.
- Participate in internal technical training and mentoring activities.
- Continuously build expertise in cryptography, cybersecurity, and security testing methodologies.