PENETRATION TESTER
Crest Security Assurance is seeking an experienced Penetration Tester to support a federal cybersecurity program This individual will serve as Key Personnel and lead the planning, coordination, execution, and reporting of enterprise penetration tests across agency systems, applications, and infrastructure.
The Penetration Tester will conduct sophisticated offensive security assessments, adversary emulation, red and purple team exercises, and breach-and-attack simulations designed to identify exploitable vulnerabilities and strengthen the agency's defensive capabilities. The ideal candidate combines deep hands-on technical expertise with strong documentation, communication, and stakeholder coordination skills.
Key Responsibilities
· Plan, coordinate, and conduct penetration tests of systems, applications, networks, and infrastructure.
· Develop, maintain, and update the Penetration Testing Concept of Operations, standard operating procedures, testing methodologies, and supporting documentation in accordance with NIST guidance, federal regulations, and industry best practices.
· Coordinate with stakeholders before each engagement to define objectives, scope, assessment methodology, target technologies, testing constraints, and success criteria.
· Develop Rules of Engagement, test plans, assessment procedures, and other engagement-specific documentation.
· Conduct red team, blue team, and purple team exercises; adversary emulation; breach-and-attack simulations; and other testing designed to improve SOC operations and the agency's overall defensive posture.
· Simulate advanced persistent threat scenarios using realistic adversary tactics, techniques, and procedures to evaluate the resilience of systems.
· Perform reconnaissance, vulnerability identification, exploitation, privilege escalation, lateral movement, persistence testing, and post-exploitation analysis within approved engagement boundaries.
· Assess web applications, operating systems, network devices, cloud environments, and other enterprise technologies for security weaknesses.
· Evaluate the effectiveness of security controls, monitoring capabilities, alerting, and incident-response processes.
· Document all vulnerabilities and findings, including evidence, risk categorization, potential impact, severity, and recommended remediation; immediately communicate critical findings requiring prompt action.
· Conduct findings triage, retesting, patch validation, and remediation verification.
· Prepare and publish comprehensive penetration-testing reports that clearly communicate results, attack paths, risk implications, and recommended corrective actions.
· Conduct post-engagement reviews identifying successful detections, control gaps, lessons learned, and opportunities to improve defensive capabilities.
· Maintain accurate tracking of penetration-testing activities, findings, remediation status, and deliverables.
· Integrate penetration testing with vulnerability assessments, threat modeling, continuous monitoring, detection engineering, incident response, and incident reporting.
· Present technical findings and risk-based recommendations to technical teams, program leadership, and executive stakeholders.
Minimum Qualifications
· Bachelor of Science in Computer Science, Information Technology, Information Security, Cybersecurity, or a related field.
· Minimum of five years of experience conducting, supporting, or leading penetration tests.
· Demonstrated experience assessing enterprise networks, systems, applications, and security controls.
· Strong knowledge of Windows and Linux operating systems, network architecture, and common networking protocols.
· Demonstrated ability to identify, validate, and safely exploit security vulnerabilities.
· Knowledge of web application technologies, common attack methods, and application-security testing practices.
· Proficiency with industry-standard penetration-testing, vulnerability-assessment, and exploitation tools.
· Proficiency with one or more scripting or programming languages used to automate testing, analyze results, or develop custom assessment capabilities.
· Experience conducting adversary emulation, red team, or purple team exercises using threat-informed tactics, techniques, and procedures.
· Experience developing Rules of Engagement, test plans, assessment documentation, and technical penetration-testing reports.
· Ability to translate complex technical findings into clear, risk-based recommendations for technical and nontechnical stakeholders.
· Strong analytical, problem-solving, technical writing, and verbal communication skills.
· U.S. citizenship and the ability to satisfy personnel-security requirements for a Non-Sensitive/High-Risk position.
Preferred Qualifications
· Offensive Security Certified Professional (OSCP), Certified Ethical Hacker (CEH), or a comparable penetration-testing certification.
· Advanced offensive security certifications such as OSCE, OSEP, OSWE, GPEN, GWAPT, GXPN, or equivalent.
· Experience conducting penetration tests within federal government or other highly regulated environments.
· Experience applying NIST guidance and federal cybersecurity requirements to penetration-testing activities and reporting.
· Experience with APT simulation and threat-informed testing based on frameworks such as MITRE ATT&CK.
· Experience evaluating SOC detection and response capabilities in coordination with blue teams.
· Experience testing cloud, identity, web application, endpoint, and network environments.
· Experience presenting findings and remediation priorities to C-suite, executive, or senior government leadership.
Pay: $135,000.00 - $145,000.00 per year
Benefits:
- 401(k)
- Dental insurance
- Health insurance
- Paid time off
- Relocation assistance
- Vision insurance
Education:
Experience:
- Penetration Testing: 5 years (Required)
License/Certification:
Work Location: Hybrid remote in Alexandria, VA 22308
