Senior Penetration Tester

Description

The company is hiring a senior penetration tester to lead security work on its hardware, software and embedded products.

The role focuses on finding and fixing weaknesses across many kinds of technology, using established testing methods and custom exploit work.

This is a remote position with some travel to customer sites in VA and to field sites when needed.

Responsibilities

• Plan how to build or reuse configurable threat suites and network setups that can scale for testing.
• Define test scenarios and automated harnesses that measure how systems detect, contain and respond to signature-based and anomaly-based threats.
• Test applications for OWASP Top Ten weaknesses and API security issues.
• Test Wi-Fi, Bluetooth and Zigbee networks for wireless and RF security flaws.
• Run in-depth vulnerability scans and risk reviews, and verify findings by hand to judge the effect on confidentiality, integrity and availability.
• Carry out full penetration tests covering hardware, software, firmware, RF and network components.
• Write and run custom exploits, proof-of-concept attacks and threat-emulation environments to show how a flaw could be used.
• Write up technical findings, rate the effort and risk of each exploit, and recommend practical fixes that strengthen the product.

Requirements

• Hold a bachelor's degree in computer science, engineering, cybersecurity, information technology or a related field.
• Have at least 5 years of experience across three or more of these areas: intelligence analysis, network engineering, network security, penetration testing, red team operations, hardware engineering, software engineering, exploit development, reverse engineering, or vulnerability assessment.
• Work well with multidisciplinary teams, customers and outside stakeholders.
• Speak clearly and confidently, including leading briefings, reaching out to customers and training users.
• Write clear technical status reports, case details and system documentation.
• Turn complex system analysis into clear reports, findings and practical recommendations.
• Be a U.S. citizen holding an active Top Secret security clearance.
• Desired: active certifications such as OSCP, PNPT, GPEN, CEH or similar offensive security credentials.
• Desired: a record of researching, building and running complex exploits and proof-of-concept attacks.
• Desired: strong background in firmware analysis, binary exploitation and embedded systems security assessments.
• Desired: experience assessing cloud designs and deployments on Amazon Web Services, Microsoft Azure and Google Cloud Platform.
• Desired: familiarity with NIST SP 800-53 security controls and risk management frameworks.

Conditions

This is a remote role that may include travel to customer sites in VA and to field sites as needed.

Pay is $155,000.00 to $170,000.00, set by experience and technical skill.

The team is open to candidates at several experience levels for its projects, and there may be a 1099 hourly option.

The company is an EEO/AA employer, and every hire must verify identity, confirm US citizenship and complete employment eligibility verification upon starting.