Junior Penetration Tester

SAIC•El Paso, TX

13h

About The Position

Science Applications International Corporation (SAIC) is seeking a Junior Penetration Tester to join its offensive security practice supporting a major state and local government customer. This early-career role focuses primarily on web application and network penetration testing, with opportunities to contribute to mobile application security assessments. Working alongside experienced testers, the Junior Penetration Tester plans and executes assessments, identifies and validates vulnerabilities, and documents results in clear, actionable reports. The role offers mentorship and opportunities to develop cybersecurity and digital forensics skills through training and hands-on practice. This position reports to the Security Assessments Manager.

Requirements

Foundational knowledge of cybersecurity concepts, including networking, operating systems, and common attack techniques.
Working knowledge of the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10, including identifying and exploiting common vulnerabilities in lab or practical settings.
Hands-on familiarity with standard web application testing and vulnerability scanning tools, such as Burp Suite and Tenable.
Basic understanding of network security concepts, including firewalls, network traffic, and access controls.
Ability to write clear, organized technical documentation and willingness to incorporate feedback and improve report quality.
Strong curiosity, problem-solving skills, and a drive to keep learning.
Must be able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout employment.

Nice To Haves

A bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field is preferred but not required; equivalent hands-on experience, such as labs, CTFs, internships, or personal projects, may be considered in lieu of a degree.
GWAPT or OSCP certification is strongly preferred; candidates holding or actively pursuing PNPT, PenTest+, PJPT, eJPT, OSEP, OSWE, OSED, or GWEB will also be considered.
Exposure to mobile application testing concepts and tools such as Frida, Objection, MobSF, and ADB, including hands-on iOS or Android assessment experience.
Familiarity with API security testing, including REST, GraphQL, or SOAP.
Exposure to source code review as part of white box testing.
Experience with CTFs, bug bounty programs, home labs, or platforms such as Hack The Box, TryHackMe, or PortSwigger Web Security Academy.
Basic scripting skills in Python, Bash, or PowerShell to automate tasks.
Introductory exposure to cloud security concepts, digital forensics, or reverse engineering.
Experience presenting technical information to peers or stakeholders, or interest in building this skill.
Ability to work collaboratively under the guidance of senior team members.

Responsibilities

Conduct penetration tests across client environments using black box and white box methodologies for web, network, and mobile targets, aligned to NIST standards.
Manage assigned tasks and workload during engagements, from scoping support through final reporting, with guidance from senior testers.
Prepare technical reports communicating findings, risk context, and actionable remediation guidance to technical and executive audiences.
Contribute to iOS and Android application security assessments and develop mobile testing capabilities.
Apply knowledge of security architectures, firewalls, network traffic, and access controls to identify and assess weaknesses.
Use commercial off-the-shelf, government off-the-shelf, and custom tools to scan for, identify, and validate vulnerabilities.
Research and evaluate tools, techniques, and technologies and recommend improvements to the team.
Present findings to customers and help explain business risk to their leadership.
Develop cybersecurity and digital forensics skills in alignment with the NICE Framework through mentorship, training, and hands-on practice.
Share knowledge with teammates, contribute to internal tooling and methodology improvements, and help address skill gaps across the practice.
Stay current on emerging vulnerabilities, attack techniques, and industry developments and share relevant knowledge with the team.