Junior Penetration Tester

SAIC•Remote Work, TX

13h•Remote

About The Position

Science Applications International Corporation (SAIC) is seeking a Junior Penetration Tester for its offensive security practice, supporting a state and local government customer. The role is intended for an early-career security professional seeking hands-on experience and mentorship. The primary focus is web application and network penetration testing, with opportunities to contribute to mobile security assessments. Working with experienced testers, the Junior Penetration Tester plans and conducts assessments, identifies and validates vulnerabilities, and documents findings in clear, actionable reports. The position reports to the Security Assessments Manager.

Requirements

Foundational knowledge of cybersecurity concepts, including networking, operating systems, and common attack techniques.
Working knowledge of the OWASP Web Security Testing Guide and OWASP Top 10, including identifying and exploiting common vulnerabilities in lab or practical settings.
Hands-on familiarity with standard web application testing and vulnerability-scanning tools, such as Burp Suite and Tenable.
Basic understanding of network security concepts, including firewalls, network traffic, and access controls.
Ability to write clear, organized technical documentation and willingness to incorporate feedback to improve report quality.
Curiosity, problem-solving skills, and motivation to keep learning.
Ability to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout employment.
A bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field is preferred but not required; equivalent hands-on experience, such as labs, CTFs, internships, or personal projects, may be considered instead.
One of the following certifications is strongly preferred: GWAPT or OSCP. Candidates holding or actively pursuing PNPT, PenTest+, PJPT, eJPT, OSEP, OSWE, OSED, or GWEB will also be considered.

Nice To Haves

Exposure to mobile application testing concepts and tools such as Frida, Objection, MobSF, or ADB, including hands-on iOS or Android assessment experience.
Familiarity with API security testing for REST, GraphQL, or SOAP.
Exposure to source code review as part of white-box testing.
Experience with CTFs, bug bounty programs, home labs, Hack The Box, TryHackMe, or PortSwigger Web Security Academy.
Basic scripting skills in Python, Bash, or PowerShell to automate tasks.
Introductory exposure to cloud security, digital forensics, or reverse engineering.
Experience presenting technical information to peers or stakeholders, or interest in developing this skill.
Ability to work collaboratively under the guidance of senior team members.

Responsibilities

Conduct penetration tests across client environments using black-box and white-box methodologies for web, network, and mobile targets, aligned with NIST standards.
Manage assigned tasks and workload within engagements, from scoping support through final reporting, with guidance from senior testers.
Produce well-structured technical reports that explain findings, risk context, and actionable remediation guidance for technical and executive audiences.
Contribute to iOS and Android application security assessments and develop mobile testing capabilities.
Apply knowledge of security architectures, firewalls, network traffic, and access controls to identify and assess weaknesses.
Use commercial, government-off-the-shelf, and custom tools to scan for, identify, and validate vulnerabilities.
Research and evaluate tools, techniques, and technologies, and recommend improvements to the team.
Build the ability to present findings to customers and explain business risk to leadership.
Develop foundational cybersecurity and digital forensics skills through mentorship, training, and hands-on practice in alignment with the NICE Framework.
Share knowledge with teammates, contribute to internal tooling and methodology improvements, and help address skill gaps across the practice.
Stay current on vulnerabilities, attack techniques, and industry developments and share relevant knowledge with the team.