Penetration Tester / Active Secret

Peraton•Arlington, VA

9d•Hybrid

About The Position

Peraton is seeking an experienced Cyber Penetration Tester to join its Federal Strategic Cyber programs. The position is based in Northern Virginia and is hybrid, with flexibility to work remotely as long as the employee can come onsite when needed. The role supports the Red Cell Team in assessing customer-system security through penetration testing, vulnerability analysis, and reporting. The tester will also help maintain Red Cell infrastructure and develop or modify tools to automate discovery or exploitation.

Requirements

Bachelor’s degree and 9 years of experience, or a master’s degree and 7 years of experience; in lieu of a degree, 4 additional years of experience may be considered.
At least 2 years of penetration testing experience.
Possess one of the listed certifications or be able to obtain one before the start date: CASP+ CE, CCNA Cyber Ops, CCNA-Security, CCNP Security, CEH, CFR, CISA, CISSP or Associate, Cloud+, CySA+, GCED, GCIA, GCIH, GICSP, or SCYBER.
Demonstrated experience with Kali Linux.
Demonstrated experience with penetration testing tools such as Nmap, Burp Suite, and Metasploit.
Ability to evaluate vulnerabilities, perform root-cause analysis, and report findings using assessment methodologies such as NIST SP 800-115, PTES, ISSAF, or the OWASP Web Security Testing Guide.
Ability to lead a penetration test and guide senior and junior penetration testers.
U.S. citizenship required.
Active Secret security clearance required.
Ability to obtain a final Top Secret security clearance.

Nice To Haves

Active Top Secret or TS/SCI clearance.
A certification in IT security competence, such as CompTIA CASP+, ISC2 CISSP, ISC2 CCSP, or ISC2 ISSEP, or an alternate verifiable certification.
A practical penetration testing certification, such as OSCP, Hack the Box CPTS, TCM Security PNPT, GIAC GXPN, or Zero Point Security Red Team Ops II, or an alternate verifiable certification.
Advanced understanding of NIST Risk Management Framework (RMF) and the Assessment and Authorization (A&A) process.
Advanced understanding of security principles, including CIA, IAAAA, access-control models, and risk management.
Advanced understanding of networking principles and technologies, including IP routing, TCP/UDP, VPNs, firewalls, and NAT.
Advanced understanding of common network protocols, including SSH, FTP, SMTP, SMB, and HTTP.
Advanced understanding of operating-system principles, including process, device, and user management and file systems.
Advanced understanding of data processing principles, including encoding, hashing, and encryption.
Advanced understanding of scripting and programming languages, including Bash, Python, PowerShell, and JavaScript.
Advanced understanding of common application vulnerabilities and exploits, including outdated components, permissions misconfigurations, lack of input validation, and logging or monitoring failures.
Advanced understanding of common web application vulnerabilities and exploits, including XSS, SQL injection, LFI, file uploads, and broken authentication mechanisms.
Advanced understanding of Active Directory enumeration and attacks, including Kerberoasting, AS-REP roasting, misconfigured privilege abuse, and golden-ticket crafting.
Advanced understanding of Public Key Infrastructure (PKI) and navigating IT environments that implement multifactor authentication.
Advanced understanding of cloud technologies and platforms, including AWS, Microsoft Azure, and Google Cloud Platform.

Responsibilities

Support the Red Cell Team by performing and leading penetration tests to assess the security of customer systems.
Identify vulnerabilities and recommend remediations to satisfy mandated NIST 800-53 security controls.
Report and demonstrate findings to system owners and engineers.
Maintain Red Cell infrastructure.
Develop or modify tools to automate discovery or exploitation.
Lead penetration tests and guide senior and junior penetration testers.