Red Team Penetration Tester

Booz Allen Hamilton • Dahlgren, VA

13h • $86,800 - $198,000 • Onsite

About The Position

The Red Team Penetration Tester supports the security of U.S. Navy computer systems, applications, servers, and networks. The role develops detailed test and assessment plans for onsite and remote security assessments and carries out attack stages such as footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks using appropriate tactics, techniques, and procedures.

The position uses vulnerability scans, compliance checks, and configuration data—including Group Policy Objects (GPOs) and Windows Software Update Services (WSUS)—to identify inconsistencies between system documentation and the security controls actually applied or deployed in information systems, platform information technology systems, IT products, and IT services. It also performs packet-level analysis with tools such as Wireshark and tcpdump to identify anomalous or malicious network traffic.

The tester uses automated tools to conduct penetration tests of networks, applications, web applications, servers, endpoints, wireless systems, and mobile technologies. The role also performs physical security testing, attempting to circumvent locks, badge readers, and other physical security controls, typically to gain unauthorized access to specific hosts.

Requirements

• At least 5 years of experience in software engineering applied to program development and modeling and simulation for DoD or IT systems.
• Experience with penetration testing, red team operations, tool or software development (including exploits and malware), C2, reverse engineering, or bug bounties, and experience with technologies such as PHP, ASP, SQL databases, Java, HTML, or NoSQL.
• Knowledge of Linux- and Windows-based systems.
• Knowledge of common penetration testing tools such as Kali, Metasploit, NMAP, and Cobalt Strike.
• Ability to debug and reverse engineer software.
• Top Secret clearance.
• High school diploma or GED.
• IAT Level II certification under DoD 8570.01 or its successor.
• Ability to obtain one of the listed certifications within 3 months of hire: OSCP, OSCE, OSEE, OSWP, SANS SEC560, SEC542, SEC660, SEC642, or SEC564.

Responsibilities

• Develop detailed test and assessment plans for onsite and remote security assessments.
• Carry out attack stages including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks using relevant TTPs.
• Use vulnerability scans, compliance checks, and configuration data such as GPOs and WSUS to identify differences between system documentation and implemented security controls.
• Perform packet-level analysis using tools such as Wireshark and tcpdump to identify anomalous or malicious network behavior.
• Use automated tools to conduct penetration tests of networks, applications, web applications, servers, endpoints, wireless technologies, and mobile technologies.
• Perform physical security testing by attempting to circumvent locks, badge readers, and other physical security controls.

Benefits

• Health, life, disability, financial, and retirement benefits.
• Paid leave.
• Professional development.
• Tuition assistance.
• Work-life programs.
• Dependent care.
• Recognition awards for exceptional performance and demonstration of company values.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: High school or GED