Penetration Tester

Description

The company is a technology firm within a global consulting group, serving US federal agencies across defense, national security, public safety, civilian, and military health work. The team is about 13,000 people.

The role provides penetration testing for an agency's information systems. The work supports security controls assessments, accreditation, continuous monitoring, and FISMA compliance, and includes wireless, RF, mobile application, and High Value Asset (HVA) testing.

Responsibilities

• Run penetration tests at the request of component leads, system owners, ISSMs, and ISSOs, and submit a Rules of Engagement (ROE) package for government approval before each test starts.
• Write detailed findings and recommendation reports for system owners, ISSMs and ISSOs, the government lead, and the agency's VAT/SOC manager, then archive the data to support remediation and retesting.
• Test wireless access points (IEEE 802.11) and RF signals (about 300 MHz to 6 GHz) at agency sites nationwide, including Puerto Rico and Guam, and keep a master travel and assessment schedule.
• Carry out mobile application assessments and Non-Tier 1 HVA assessments, including the CISA Operator Role portion, and produce reports in the format CISA prescribes.
• Support adversarial assessments: join initial engagement meetings, build and run Cyber Table-Top (CTT) scenarios, and carry out Cooperative Vulnerability Penetration Assessments (CVPA).
• Work with the SOC, CTI, and CDF teams to find or emulate IOCs, TTPs, and CWEs.
• Travel within the continental US and outside it to run onsite security assessments of agency facilities, systems, and applications.
• Maintain a repository and metrics for past penetration tests, and help deliver annual ISSO training on VAT services and capabilities.

Requirements

• Have at least 7 years of professional penetration testing and offensive security experience. A bachelor's degree in computer science, engineering, information technology, cybersecurity, or a related field reduces that to 5 years.
• Have hands-on experience with penetration testing methods, wireless and RF assessment tools, mobile application security testing, and CISA HVA assessment procedures.
• Preferred certifications: OSCP (Offensive Security Certified Professional), GPEN (GIAC Penetration Tester), or CEH (Certified Ethical Hacker).

Conditions

Travel is frequent, both within the continental US and outside it, including Puerto Rico and Guam, for onsite wireless, RF, and physical-security work.

Pay range for California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia: $106,300 to $206,200 USD base pay. Actual pay depends on office location, role, skill set, and experience.

Applications are accepted on an ongoing basis with no fixed deadline.

Equal opportunity is a core commitment of the company.

Benefits

• A wide range of benefits is offered, and certifications, industry training, and hands-on experience support growth.