Red Team Penetration Tester

Booz Allen Hamilton • Dahlgren, VA

1d • $86,800 - $198,000

About The Position

As a Red Team Penetration Tester, you will help safeguard US Navy computer systems, applications, servers, networks, and other critical digital environments. You will support onsite and remote security assessments by developing detailed test and assessment plans and carrying out attack stages using relevant Tactics, Techniques, and Procedures (TTPs), including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks.

You will use vulnerability scans, compliance checks, and configuration data—including Group Policy Objects (GPOs) and Windows Software Update Services (WSUS)—to identify discrepancies between system documentation and security controls actually applied or deployed in information systems, Platform Information Technology systems, IT products, and IT services. You will perform packet-level analysis with tools such as Wireshark and tcpdump to identify anomalous or malicious behavior in network traffic.

The role also involves using automated tools to conduct penetration tests of networks, applications, web applications, servers, endpoints, wireless systems, and mobile technologies. You will perform physical security testing by attempting to circumvent locks, badge readers, and other controls to identify vulnerabilities and potentially gain unauthorized access to specific hosts.

Requirements

• At least 5 years of experience in software engineering applied to program development and modeling and simulation for DoD or IT systems.
• Experience with penetration testing, red team operations, or tool/software development, including areas such as exploits and malware, command and control (C2), reverse engineering, bug bounties, PHP, ASP, SQL databases, Java, HTML, or NoSQL.
• Knowledge of Linux- and Windows-based systems.
• Knowledge of common penetration testing tools such as Kali, Metasploit, Nmap, and Cobalt Strike.
• Ability to debug and reverse engineer software.
• Top Secret clearance.
• High school diploma or GED.
• IAT Level II certification under DoD 8570.01 or a successor.
• Ability to obtain one of the listed certifications within 3 months of hire: OSCP, OSCE, OSEE, OSWP, SANS SEC560, SEC542, SEC660, SEC642, or SEC564.

Responsibilities

• Develop detailed test and assessment plans for onsite and remote security assessments.
• Carry out attack stages such as footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks using TTPs.
• Use vulnerability scans, compliance checks, and configuration data, including GPOs and WSUS, to identify inconsistencies between system documentation and applied security controls.
• Perform packet-level network analysis using tools such as Wireshark and tcpdump to identify anomalous or malicious traffic behavior.
• Use automated tools to conduct penetration tests of networks, applications, web applications, servers, endpoints, wireless systems, and mobile technologies.
• Perform physical security testing by attempting to circumvent locks, badge readers, and other physical security controls.

Benefits

• Health, life, disability, financial, and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED