Full Job Description
Penetration Tester - Cyber Engineer
This is a full-time position, 100% on-site at Aberdeen Proving Ground, MD. An active Secret clearance is required to start, and the position requires up to 25% CONUS travel.
This successful candidate will be responsible for the following:
• Perform in-depth assessments and analyses of sophisticated systems using penetration testing and threat-hunting techniques.
• Conduct grey and black box penetration testing against systems and electronics.
• Apply exploitation techniques such as buffer overflows, fuzzing, SQL injection, man-in-the-middle attacks, covert channels, secure tunneling, XSS, privilege escalation, and lateral movement.
• Disassemble devices and identify hardware components to support assessments.
• Develop and present proofs of concept that demonstrate exploitation techniques.
• Collaborate with a multi-disciplinary engineering team to develop solutions to complex problems.
Required Qualifications
• Active Secret clearance with the potential to obtain TS/SCI.
• Bachelor's degree in a related field and 5 years of relevant experience.
Required Experience
• Professional experience in penetration testing or threat hunting, including a minimum of 2-3 years of exploitation experience.
• Proven experience in grey and black box penetration testing.
• In-depth understanding of OWASP Top 10, DoD, NSA, or industry-standard vulnerability and penetration testing standards.
• Proficiency with penetration testing tools such as nmap, Wireshark, Burp Suite, Nessus, and similar utilities.
• Extensive knowledge of Linux operating systems.
• Expertise in exploitation techniques including buffer overflows, fuzzing, SQL injection, man-in-the-middle attacks, covert channels, secure tunneling, XSS, privilege escalation, and lateral movement.
• Strong grasp of networking, TCP/IP, virtualization, and web services.
• Familiarity with interfacing with electronic hardware (e.g., taking apart devices and identifying hardware components).
Preferred Qualifications
• Active TS/SCI clearance.
• Certifications such as OSCP, OSCE, GPEN, GWAPT, GXPN, CEH, or CISSP.
• Experience in malware analysis or digital computer forensics.
• Scripting skills in Bash, Python, Perl, or Ruby.
• Systems programming experience.
• Strong interest in emerging penetration testing technologies and techniques.
• Familiarity with Android operating systems.
• Knowledge of UAS/UxS technologies.
• Understanding of radios and radio protocols.
• Experience analyzing embedded devices.
• Experience developing and presenting proofs of concept to demonstrate exploitation techniques.
