Senior Penetration Tester

ANALYGENCE, Inc.

Washington, DC, United States

1 day ago

Apply on diversityjobs.com

Prepare application

Role details

Contract type

Permanent contract

Employment type

Full-time (> 32 hours)

Experience level

Expert

Experience required

2 years minimum

Working hours

Regular working hours

Job source

diversityjobs.com

Tech stack

Xacta Application Programming Interfaces (APIs) Software System Penetration Testing Cloud Computing Security Static Program Analysis Code Review Continuous Integration Dynamic Program Analysis Information Security Management Open Web Application Security Red Team (Cyber Security) Zero Trust Network Access

+7 more

Software Vulnerability Management Mitre Att&ck RSA Archer Platform Devsecops Plan of Action and Milestones Vulnerability Analysis Microservices

Job description

Conduct penetration testing, vulnerability assessments, software assurance, and cyber supply chain risk management activities for Federal mission systems.
Perform full-scope security testing using established methodologies such as MITRE ATT&CK, OWASP, NIST 800-115, and related Federal or IC assessment practices.
Support pre-engagement planning, rules of engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
Use approved automated and manual testing methods to identify vulnerabilities, validate exploitability, and assess potential business and operational impacts.
Identify vulnerabilities commonly missed by automated tools through manual, expert-driven testing techniques.
Assess SOC detection and response capabilities through controlled testing activities.
Produce penetration testing reports, vulnerability assessment reports, software assurance recommendations, and corrective action guidance.
Support software assurance through vulnerability and compliance testing, source code review, static/dynamic analysis, dependency review, and software supply chain risk identification.
Conduct vulnerability assessments and interpret results to recommend corrective actions and mitigation strategies.
Support secure cloud, hybrid, DevSecOps, application, identity, API, microservices, CI/CD, Zero Trust, and cross-domain assessment activities.
Maintain secure testing kits and assessment tooling, including patching, configuration updates, and approved tool management.
Update and maintain penetration testing, SCRM, and vulnerability assessment procedures.
Support audits, working groups, and stakeholder briefings related to penetration testing, software assurance, vulnerability assessment, and cyber supply chain risk.
Identify opportunities to improve testing processes, automate assessment workflows, strengthen reporting, and produce useful metrics for leadership and technical stakeholders.
Translate assessment findings into actionable remediation plans, risk insights, POA&M inputs, dashboards, and decision-ready reporting.

Requirements

10+ years of related cybersecurity assessment, penetration testing, software assurance, vulnerability assessment, or cyber supply chain risk experience.
2+ years of recent experience in each of the following areas: software assurance, penetration testing with automated tools, vulnerability assessment, security patch management, secure cloud and hybrid engineering, and
Cross Domain Solutions.
CEH and CISSP certifications, or comparable demonstrable experience.
Experience conducting penetration testing, vulnerability assessments, software assurance, source code review, SCRM, and cyber supply chain management activities.
Experience using both automated tools and manual testing processes to identify, validate, and document vulnerabilities.
Experience producing technical reports, corrective action recommendations, mitigation strategies, and executive-ready summaries.
Strong understanding of vulnerability management, exploitability, secure configuration, remediation validation, and operational risk.
Strong written and verbal communication skills.
Ability to work onsite at a government-approved location as required., * Prior DHS, Intelligence Community, DoD, CISA, classified red team, software assurance, SCRM, CVPA, vulnerability research, or national security cyber assessment experience.
Experience with MITRE ATT&CK, OWASP, NIST 800-115, IC “Raise the Bar,” NIST SP 800-161, CNSSI 1253, DHS 4300C, or related Federal/IC cybersecurity frameworks.
Experience testing cloud, application, identity, API, microservices, CI/CD, DevSecOps, Zero Trust, cross-domain, and hybrid TS/SCI environments.
Experience with SBOM analysis, static/dynamic code analysis, dependency review, source code review, exploit validation, secure configuration, and remediation validation.
Experience with GRC platforms such as Archer, eMASS, or Xacta, including the ability to translate findings into POA&Ms, dashboards, scorecards, and remediation workflows.