Bachelor's degree in cybersecurity, computer science, IT, or related field; or 10+ years of relevant experience without a degree.
At least 7 years of experience in Red Team assessments and penetration testing, focusing on web applications.
Active OSCP+ certification plus one of the following: CompTia PenTest+, CEH, CompTia CySa+, GCIH, GCFA, or CISSP.
Expertise in scripting languages such as Python, PowerShell, Java, and Perl.
Solid understanding of business/application logic vulnerabilities and API-focused penetration testing.
Responsibilities
Plan, create, and execute advanced penetration tests focusing on web applications.
Assess and evaluate the security of internal networks and application infrastructure.
Conduct penetration testing for Azure cloud infrastructures and applications.
Lead and mentor a team of penetration testers, sharing expertise and guidance.
Simulate security breaches to analyze system security effectiveness.
Compile detailed reports with findings, risk assessments, and recommendations for management.
Coordinate penetration test intake and liaise with client teams for scheduling and report delivery.
Benefits
Hybrid work schedule offering flexibility between office and remote work.
Opportunities for professional development and continuous learning in a rapidly evolving field.
Exposure to a diverse range of technologies and security challenges.
Chance to lead and influence a team of skilled professionals in cybersecurity.
Engagement in meaningful projects that contribute to enhancing organizational security.
Full Job Description
Job Title: Senior Penetration Tester
Pay Type: SALARIED EXEMPT
Location: Hybrid, Washington, DC
US Citizenship: Required
Summary of Position Role/Responsibilities
Essential Functions of the Job
Plan, create, and execute advanced penetration methods, scripts, and tests[OS1] for the team, with a focus on Web Applications[OS2]
Assess and test the security of internal networks and underlying application infrastructure.
Conduct penetration testing and vulnerability assessments on Azure cloud infrastructure and applications
Lead and mentor a team of penetration testers, providing guidance and sharing expertise
Carry out remote and on-site testing of client networks and infrastructure to expose security weaknesses
Simulate security breaches to assess a system's relative security
Create detailed reports and recommendations based on findings, including uncovered security issues and associated risk levels
Present findings, risk assessments, and conclusions to management and other relevant parties
Maintain advanced knowledge of networking, cryptography, reverse engineering, web applications, operating systems databases
Possess expertise in various scripting and programming languages, including Python, SQL, C/C++, JavaScript, PHP, Java, and Ruby
Provide strong written and oral communication skills to effectively convey assessment results and potential weaknesses
Assist in penetration testing intake, coordination with client teams for scheduling and delivery of reports/debriefs.
Marginal Functions of the Job
Other duties as assigned
Normal Work Schedule
This is a full-time position. Standard business hours are Monday through Friday 8:00 AM to 5:3 PM. If your role falls within our Security Operations Center, you will be assigned a specific shift. As a result, your working schedule may require flexibility to cover any shift that falls within a 24/7 cycle, it may also change and rotate, including nights, weekends, and holidays.
Education, Training, and Experience
Bachelor's degree in cyber security, computer science, IT or a related field and at least 10 years of experience in cybersecurity. Additional years of relevant experience may be considered in lieu of a Bachelor's degree.
7 years minimum of work experience directly related to Red Team assessments, and penetration testing (intranet, internet, web, wireless, social engineering), with a focus on Web Application testing
Must have an active OSCP+ certification in addition to one of the following:
CompTia PenTest+
CEH
CompTia CySa+
GCIH
GCFA
CISSP
Expertise with scripting languages (e.g., Python, PowerShell, Java, Perl, etc)
A fundamental understanding and experience with business/application logic vulnerabilities. [OS3]
