Penetration Tester (Hybrid)

Koniag Government Services, LLC•Washington, DC

8d•$140,000 - $165,000•Hybrid

About The Position

Koniag Operations Services, a Koniag Government Services company, is seeking a skilled, detail-oriented Penetration Tester to support security assessment initiatives for KOS and a government customer in Washington, DC. This hybrid position requires the ability to obtain and maintain a Public Trust clearance. The role conducts authorized simulated attacks on systems, networks, and applications to identify vulnerabilities, assess risk, and strengthen security before malicious actors can exploit weaknesses. The Penetration Tester performs penetration tests and vulnerability assessments, develops and executes test plans, uses industry-standard tools and custom scripts, documents findings, and presents actionable recommendations to technical teams and leadership. The position collaborates with administrators, developers, and security teams on remediation; may conduct social engineering assessments; participates in red team/blue team and purple team activities; and supports enterprise monitoring and security assessments. All testing must comply with rules of engagement, legal requirements, and organizational policies.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field from an accredited college or university; equivalent experience may be considered in lieu of a degree.
3–5 years of experience in penetration testing, ethical hacking, or offensive security roles.
Demonstrated experience conducting network, web application, and/or wireless penetration tests.
Experience with scripting languages such as Python, Bash, or PowerShell for tool development and automation.
Exceptional written and oral communication skills, including the ability to translate technical findings into actionable business recommendations for technical and non-technical stakeholders.
Strong understanding of networking protocols, Windows and Linux operating systems, and system architectures.
Hands-on experience with penetration testing tools including Metasploit, Burp Suite, Nmap, Wireshark, and Kali Linux.
Knowledge of OWASP Top 10, MITRE ATT&CK, and CVSS scoring.
Experience conducting internal and external penetration tests.
Ability to think creatively and adopt an attacker’s mindset to identify non-obvious security weaknesses.
Strong understanding of security concepts, including encryption, authentication, and access control mechanisms.
Ability to work independently and manage multiple engagements under tight deadlines.
Strong report-writing skills, with attention to detail and accuracy.
Ability to obtain and maintain a Public Trust clearance.

Nice To Haves

Experience working in a federal government IT environment supporting security assessments.
Industry certifications such as OSCP, GPEN, CEH, or CISSP.
Experience with cloud security assessments for AWS, Azure, or GCP.
Familiarity with red team operations and adversary emulation techniques.
Knowledge of secure coding practices and application security testing (SAST/DAST).
Experience with container and Kubernetes security testing.
Familiarity with compliance frameworks such as NIST 800-53, FedRAMP, or RMF.

Responsibilities

Perform penetration testing on networks, web applications, mobile applications, and infrastructure to identify security weaknesses.
Conduct vulnerability assessments and exploit identified vulnerabilities in a controlled, authorized manner.
Develop and execute test plans covering reconnaissance, scanning, exploitation, and post-exploitation activities.
Use industry-standard tools and techniques to assess system security.
Write custom scripts and tools to automate testing and support exploit development as needed.
Document findings in detailed technical reports, including risk ratings, exploitation methods, and remediation recommendations.
Present findings and recommendations clearly and actionably to technical teams and leadership.
Collaborate with system administrators, developers, and security teams to validate and remediate vulnerabilities.
Conduct social engineering assessments, including phishing campaigns, when required.
Stay current on emerging threats, attack vectors, and penetration testing methodologies.
Participate in red team/blue team exercises and support purple team collaboration.
Ensure testing complies with rules of engagement, legal requirements, and organizational policies.
Support continuous monitoring and security assessment efforts across the enterprise.