Red Team Penetration Tester

Booz Allen Hamilton•Virginia Beach, VA

21h•$86,800 - $198,000•Hybrid

About The Position

As a penetration tester, you'll play a pivotal role in safeguarding our critical digital environments. Your ability to provide support by developing detailed test and assessment plans to be used during on-site and remote security assessments, and by understanding and carrying-out attack stages such as foot printing and scanning, enumeration, gaining access, escalation or privileges, maintaining access, network exploitation, and covering tracks, using one or more Tactics, Techniques, and Procedures (TTPs), will ensure the security of U.S. Navy computer systems, applications, servers, and networks. You will provide support to customers by utilizing vulnerability scans, compliance checks, and other configuration data such as Group Policy Objects (GPOs) and Windows Software Update Service (WSUS), to accurately identify specific inconsistencies within system documentation such as vendor claims, Risk Management Framework (RMF) artifacts, CONOPS, systems engineering plans, design specifications, and interface descriptions, and the actual applied security controls as developed or deployed within an information system, Platform Information Technology (PIT) system, Information Technology (IT) product, or provided in IT services. You will also provide customer support by performing packet-level analysis using appropriate tools such as Wireshark and tcp dump, to identify specific information within network packets indicating anomalous or malicious behavior within network traffic flows. In this role, you’ll be instrumental in providing support by utilizing automated tools to conduct penetration tests of networks, applications, web applications, servers, endpoints, and wireless and mobile technologies, and providing support by performing physical security testing to exploit physical security vulnerabilities by attempting to circumvent locks, badge readers, and other physical security controls, typically to gain unauthorized access to specific hosts.

Requirements

5+ years of experience in software engineering applied to program development, and modeling and simulation applied to DoD or IT systems
Experience in Penetration Testing (PENTEST), Red Team operations, PHP, ASP, SQL databases, Java, HTML, NoSQL, and tool or software development such as exploits or malware, C2, reverse engineering, and bug bounties
Knowledge of Linux and Windows-based systems
Knowledge of common PENTEST tools such as Kali, Metasploit, NMAP, and Cobalt Strike
Ability to debug and reverse engineer software
Ability to travel up to 25% of the time
Secret clearance
HS diploma or GED
DoD 8570.01 IAT Level II Certification

Nice To Haves

Ability to obtain an OSCP, OSCE, OSEE, OSWP, SANS Certs: SEC560 - Network PENTEST and Ethical Hacking, SEC542 - Web App PENTEST and Ethical Hacking, SEC642 -Advanced Web App PENTEST and Ethical Hacking, SEC564 - Red Team Operations and Threat Emulation, or SEC660 - Advance PENTEST, Exploit Writing, and Ethical Hacking Certification within 3 months of hire date

Responsibilities

Develop detailed test and assessment plans for on-site and remote security assessments.
Carry out attack stages including foot printing and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, and covering tracks using TTPs.
Utilize vulnerability scans, compliance checks, and configuration data (GPOs, WSUS) to identify inconsistencies in system documentation and applied security controls.
Perform packet-level analysis using tools like Wireshark and tcp dump to identify anomalous or malicious network traffic.
Conduct penetration tests of networks, applications, web applications, servers, endpoints, and wireless and mobile technologies using automated tools.
Perform physical security testing to exploit vulnerabilities in locks, badge readers, and other physical security controls.