> Markdown version of [/jobs/ext/4615935-penetration-tester](https://www.wearedevelopers.com/jobs/ext/4615935-penetration-tester). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Penetration Tester

- **Company:** Purple Jay LLC
- **Location:** Ashburn, VA, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Active Directory, Artificial Intelligence, Business Logic, Software System Penetration Testing, Burp Suite, Linux, Python (Programming Language), Nmap, Open Web Application Security, Cloud Services, Security Information and Event Management, Web Applications, Metasploit, Cybercrime, Nessus, Api Management, Human in the Loop
- **Published:** November 7, 2026
- **Apply:** https://www.thejobnetwork.com/job/788f9a9d-6c82-4fbb-bd6d-a2cbc3e26f34/penetration-tester

## About the Role

* Applicants must hold the Offensive Security Certified Professional (OSCP) certification or have 3 to 5 years of hands-on professional penetration testing experience.
\n

 * Applicants must be able to obtain and maintain a federal background investigation (Public Trust or higher).
\n

 * Applicants must be a US Citizen.
\n, * Clear written communication for both engineering and executive audiences.
\n

 * Sound judgment in production environments, including knowing when to stop, escalate, or ask.
\n

 * The ability to quickly build working proficiency in unfamiliar technologies. Our assessment targets range from enterprise networks and cloud services to industrial automation, medical devices, and physical facilities, and each engagement can bring a new domain.
\n

 * Strong sense of personal accountability regarding decision-making and coordinating across different project and department teams
\n

 * Experience working in a high-level collaborative environment and promoting a teamwork mentality.
\n

 * Proven ability to build and maintain effective relationships with stakeholders at all levels, including technical teams, management, and clients.
\n, * Hands-on network penetration testing experience across Linux and Windows environments, including Active Directory attacks, privilege escalation, lateral movement, and pivoting.
\n

 * Web application and API testing experience covering the OWASP Top 10, authentication and authorization flaws, and business logic issues.
\n

 * Practiced with offensive security tooling such as Burp Suite Professional, Nessus, Nmap, Metasploit, Cobalt Strike, BloodHound, Impacket, and NetExec.
\n

 * Threat hunting experience, or a solid working knowledge of how attacker activity shows up in EDR, SIEM, and network telemetry.
\n

 * A strong understanding of threat modeling. You don't stop at finding vulnerabilities. You explain what they mean for the specific system and mission, how an adversary would chain them together, and which fixes or mitigations matter most.
\n

 * Proficiency in Python or a similar language for exploit development, automation, and tooling.
\n

 * Proven skill using AI tooling for human-in-the-loop security testing. You use AI to speed up reconnaissance, analysis, scripting, and reporting, and you independently verify everything it produces. Every finding you deliver is one you can explain and defend yourself.
\n

## Description

Our Threat Resilience team answers specific security questions for federal programs with hands-on evidence, inside a fixed window. When a system's risk can't be settled by documentation and vendor attestation alone, we test it directly from an attacker's point of view. We then put what we find in the context of real threats and give the decision maker a defensible answer with practical fixes. Engagements range from a bounded technical check, to a focused assessment across several components, to a deep evaluation spanning multiple trust boundaries.