Red Team Penetration Tester

Booz Allen Hamilton•Usa, VA

About The Position

As a Red Team Penetration Tester, you will help safeguard U.S. Navy computer systems, applications, servers, and networks. You will support on-site and remote security assessments by developing detailed test and assessment plans and carrying out attack stages using one or more Tactics, Techniques, and Procedures (TTPs), including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks. You will use vulnerability scans, compliance checks, and configuration data—including Group Policy Objects (GPOs) and Windows Software Update Services (WSUS)—to identify inconsistencies between system documentation and the security controls applied or deployed in information systems, Platform Information Technology (PIT) systems, IT products, and IT services. You will perform packet-level analysis with tools such as Wireshark and tcpdump to identify anomalous or malicious network traffic. You will also use automated tools to test networks, applications, web applications, servers, endpoints, wireless and mobile technologies, and conduct physical security tests intended to exploit weaknesses in locks, badge readers, and other controls.

Requirements

5+ years of experience in software engineering applied to program development, and modeling and simulation applied to DoD or IT systems.
Experience with penetration testing, red team operations, tool or software development such as exploits and malware, C2, reverse engineering, and bug bounties.
Experience with PHP, ASP, SQL databases, Java, HTML, or NoSQL.
Knowledge of Linux and Windows-based systems.
Knowledge of common penetration-testing tools such as Kali, Metasploit, Nmap, and Cobalt Strike.
Ability to debug and reverse engineer software.
Ability to travel up to 25% of the time.
Top Secret clearance; selected applicants will be subject to a security investigation and may need to meet eligibility requirements for classified information access.
High school diploma or GED.
IAT Level II DoD 8570.01 certification.
Ability to obtain one of the listed certifications within 3 months of hire: OSCP, OSCE, OSEE, OSWP, SANS SEC560, SEC542, SEC660, SEC642, or SEC564.

Responsibilities

Develop detailed test and assessment plans for on-site and remote security assessments.
Carry out attack stages including footprinting and scanning, enumeration, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks using TTPs.
Use vulnerability scans, compliance checks, and configuration data, including GPOs and WSUS, to identify inconsistencies between system documentation and applied security controls.
Perform packet-level analysis using tools such as Wireshark and tcpdump to identify anomalous or malicious network behavior.
Use automated tools to conduct penetration tests of networks, applications, web applications, servers, endpoints, wireless technologies, and mobile technologies.
Perform physical security testing by attempting to circumvent locks, badge readers, and other physical security controls, typically to gain unauthorized access to specific hosts.
Support the security of U.S. Navy computer systems, applications, servers, and networks.