Senior Penetration Tester

SkyePoint Decisions•Laurel, MD

3d•Onsite

About The Position

SkyePoint Decisions is seeking a Senior Pen Tester/Pentest Operator to support a Department of State program. This contingent position is subject to customer approval. The role supports and leads penetration testing engagements on High Value Asset (HVA) systems and enterprise security assessments, helping clients understand real-world attack paths, validate defensive controls, and prioritize remediation based on mission risk. Work includes internal and external network testing, web application testing, Active Directory assessment, adversary emulation, red and purple team activities, vulnerability validation and reporting, and executive-level out-briefs. The position is located in Beltsville, Maryland and is onsite five days a week; hybrid and telework are not allowed. The successful candidate will work with technical operators, analysts, engineers, and government stakeholders in commercial and federal environments, communicating technical findings as risk-based recommendations to system owners, security teams, and senior leaders.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field; additional relevant experience may be considered in lieu of a degree.
At least five years of demonstrated hands-on experience in penetration testing, red team operations, adversary emulation, vulnerability assessment, application security testing, cyber operations, or related offensive security work.
Active and maintained Secret Federal or DoD security clearance.
Experience performing internal and external network penetration testing, including reconnaissance, enumeration, exploitation, privilege escalation, lateral movement, and attack-path documentation.
Experience performing web application penetration testing using manual and automated techniques.
Experience assessing Active Directory environments, Windows and Linux systems, and common enterprise network services.
Experience using common penetration testing tools, such as Burp Suite, Metasploit, Nmap, Nessus, Kali Linux, Wireshark, BloodHound, Impacket, Responder, Hashcat, John the Ripper, Cobalt Strike, Sliver, or similar tools.
Experience developing test plans, documenting Rules of Engagement, tracking assessment activities, and producing formal penetration test reports.
Ability to explain technical findings, attack paths, business impact, and remediation options to technical and non-technical stakeholders.
Strong written and verbal communication skills, including the ability to develop client-ready deliverables and executive-ready summaries.
Ability to work independently, manage multiple priorities, and collaborate across multidisciplinary teams in complex federal environments.
U.S. citizenship is required for most positions; the posting does not specify whether this particular position is among them.

Nice To Haves

Active and maintained Top Secret Federal or DoD security clearance.
Experience supporting HVA cybersecurity assessments or federal enterprise penetration testing programs.
One or more relevant offensive security certifications, such as OSCP, GPEN, GWAPT, GXPN, GRTP, PenTest+, CEH, GCIH, or similar.
Experience with adversary emulation, purple team operations, detection engineering support, or validation of SIEM and EDR detection coverage.
Experience with Cobalt Strike, Sliver, custom payload development, or command-and-control simulation in approved assessment environments.
Experience with cloud security testing or assessment activities across AWS, Azure, or other cloud environments.
Experience supporting incident response, threat hunting, or post-incident analysis.
Experience creating proof-of-concept exploit examples for reports or live demonstrations in controlled, authorized environments.
Experience mentoring junior penetration testers or leading small offensive security workstreams.
Excellent oral and written communication and presentation skills.

Responsibilities

Perform penetration testing across internal and external networks, web applications, enterprise systems, cloud-connected systems, and mission environments.
Support HVA cybersecurity assessments by identifying exploitable vulnerabilities, validating security control effectiveness, and determining risks to critical systems and data.
Conduct network mapping, reconnaissance, vulnerability validation, exploitation, post-exploitation analysis, and attack-path documentation within approved Rules of Engagement.
Draft or contribute to Rules of Engagement, test plans, objectives, scope documentation, and assessment procedures for management and stakeholder approval.
Conduct external testing to evaluate what an outside attacker could access, exploit, or exfiltrate within the approved scope.
Conduct internal testing to assess risks associated with users and systems at different access levels, including privilege escalation, lateral movement, persistence, and Active Directory attack paths.
Support red team and adversary emulation activities that simulate realistic threat behavior, including targeted access objectives, command-and-control simulation, crafted test artifacts, and authorized controlled social engineering.
Test web applications for common vulnerability classes, including broken access control, authentication and authorization weaknesses, injection flaws, cross-site scripting, insecure configuration, and other OWASP Top 10 risks.
Use offensive security tools and frameworks within approved engagement boundaries.
Drive vulnerability analysis and validation using manual techniques, automated tools, and custom scripts or proof-of-concept code where appropriate.
Support purple team and detection-validation activities by mapping attacker behavior to defensive telemetry, identifying detection gaps, and recommending improvements to SIEM, EDR, and incident response processes.
Analyze logs, endpoint artifacts, and network telemetry during exercises or assessments to help validate detection and escalation of adversary behavior.
Write and present evidence-based reports documenting findings, affected assets, exploitability, business or mission impact, and prioritized remediation recommendations.
Deliver technical and executive out-briefs to system owners, security operations teams, engineering teams, and senior leaders.
Stay current on emerging attack techniques, offensive tooling, detection approaches, and federal cybersecurity requirements, and apply that knowledge to strengthen client security posture.

Benefits

Certification incentive program for certifications aligned with business needs.
Paid time off (PTO).
Floating federal holiday options.
Insurance options, including HMO and High Deductible plans with Health Savings Accounts (HSAs).
Flexible Spending Accounts (FSAs).
Full dental plans.
Vision coverage.
Short-term and long-term disability insurance.
Life insurance.
401(k) with company match.
Flexible work environment.