Penetration Tester (Hybrid)

Koniag Government Services•Washington, DC

5d•Hybrid

About The Position

Koniag Operations Services, a Koniag Government Services company, is seeking a skilled and detail-oriented Penetration Tester to support security assessment initiatives for KOS and a government customer in Washington, DC. The position is hybrid and requires the ability to obtain and maintain a Public Trust clearance. The ideal candidate has a strong technical background and ethical mindset and can use offensive security skills and analytical expertise to identify vulnerabilities, assess risks, and strengthen the security posture of complex systems and networks. The Penetration Tester conducts authorized simulated attacks on systems, networks, and applications to find security vulnerabilities before malicious actors can exploit them. The role involves assessing security, documenting and communicating findings, and collaborating with technical teams to validate and remediate vulnerabilities. Candidates are encouraged to apply as soon as possible.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field from an accredited college or university; equivalent experience may be considered in lieu of a degree.
3–5 years of experience in penetration testing, ethical hacking, or offensive security roles.
Demonstrated experience conducting network, web application, and/or wireless penetration tests.
Experience with scripting languages such as Python, Bash, or PowerShell for tool development and automation.
Exceptional written and oral communication skills, including the ability to translate technical findings into actionable recommendations for technical and non-technical stakeholders.
Strong understanding of networking protocols, Windows and Linux operating systems, and system architectures.
Hands-on experience with penetration testing tools, including Metasploit, Burp Suite, Nmap, Wireshark, and Kali Linux.
Knowledge of vulnerability frameworks and standards, including OWASP Top 10, MITRE ATT&CK, and CVSS scoring.
Experience conducting both internal and external penetration tests.
Ability to think creatively and adopt an attacker’s mindset to identify non-obvious security weaknesses.
Strong understanding of security concepts, including encryption, authentication, and access control mechanisms.
Ability to work independently and manage multiple engagements under tight deadlines.
Strong report-writing skills with attention to detail and accuracy.
Ability to obtain and maintain a Public Trust clearance.

Nice To Haves

Experience working in a federal government IT environment supporting security assessments.
Industry certifications such as OSCP, GPEN, CEH, or CISSP.
Experience with cloud security assessments in AWS, Azure, or GCP.
Familiarity with red team operations and adversary emulation techniques.
Knowledge of secure coding practices and application security testing (SAST/DAST).
Experience with container and Kubernetes security testing.
Familiarity with compliance frameworks such as NIST 800-53, FedRAMP, or RMF.

Responsibilities

Perform penetration testing on networks, web applications, mobile applications, and infrastructure to identify security weaknesses.
Conduct vulnerability assessments and exploit identified vulnerabilities in a controlled, authorized manner.
Develop and execute test plans covering reconnaissance, scanning, exploitation, and post-exploitation activities.
Use industry-standard tools and techniques to assess system security.
Write custom scripts and tools to automate testing and support exploit development as needed.
Document findings in detailed technical reports, including risk ratings, exploitation methods, and remediation recommendations.
Present findings and recommendations clearly and actionably to technical teams and leadership.
Collaborate with system administrators, developers, and security teams to validate and remediate vulnerabilities.
Conduct social engineering assessments, including phishing campaigns, when required.
Stay current on emerging threats, attack vectors, and penetration testing methodologies.
Participate in red team and blue team exercises and support purple team collaboration.
Ensure testing complies with rules of engagement, legal requirements, and organizational policies.
Support continuous monitoring and enterprise security assessment efforts.