The Penetration Tester executes structured offensive security assessments across WDP's classified and unclassified environments under senior testing leadership, validating the security posture of mission-critical network infrastructure, web applications, cloud components, and operational data platform services spanning NIPRNet, SIPRNet, and JWICS. This role directly supports WDP's Risk Management Framework compliance obligations, Authorization to Operate activities, and continuous monitoring requirements by delivering technically rigorous, evidence-based findings that enable timely remediation and strengthen the platform's defense-in-depth posture.
• Executes offensive security assessments supporting Department of War information systems across unclassified and classified environments under the direction of senior testing leadership.
• Conducts network and web application penetration testing activities to identify exploitable vulnerabilities, insecure configurations, and attack paths that bypass automated security controls.
• Performs reconnaissance, enumeration, exploitation, and post-exploitation activities using approved tools and techniques while adhering to established rules of engagement and operational safety constraints.
• Executes testing against operating systems, databases, web services, APIs, and cloud-hosted components to validate security control effectiveness and defense-in-depth posture.
• Documents technical findings including exploitation steps, evidence artifacts, and impact analysis in structured penetration testing reports.
• Collaborates with system owners, ISSOs, and cybersecurity engineers to deconflict testing activity and support timely remediation planning.
• Assists with red team activities by executing assigned attack scenarios and validating detection and response capabilities.
• Supports remediation verification through retesting of previously identified vulnerabilities to confirm corrective action effectiveness.
• Maintains detailed testing notes, screenshots, logs, and artifacts supporting Risk Management Framework assessment activities and authorization documentation.
• Contributes to continuous improvement of testing methodologies, toolkits, and playbooks while reinforcing program values of professionalism, discipline, accountability, and proactive cyber defense in support of mission assurance.
• Performs other duties as assigned.
• Current Secret security clearance with the ability to obtain and maintain a Top Secret (TS) security clearance.
• 3-10 years of experience in penetration testing, offensive security, vulnerability assessment, or a closely related cybersecurity discipline, with demonstrated hands-on experience conducting structured penetration testing engagements across network, web application, and cloud environments in federal, DoW, or enterprise settings.
• IAM Level I certification from an approved credential, including CompTIA Security+ CE, ISCB2 CAP, ISCB2 SSCP, or GIAC GSLC.
• Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.
• Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management).
