Penetration Tester

About This Role

This role involves executing network, system, application, and specialized penetration tests against FAA infrastructure under the direction of a lead. The successful candidate will work within formal Rules of Engagement, operate FAA-approved tools, and produce technically detailed test reports. You will also participate in red team and blue team exercises in simulated environments. This position supports a proposal effort and is contingent upon award, customer approval, and successful onboarding requirements.

Responsibilities

• Execute penetration tests against NAS and Mission Support systems, networks, and applications following approved Rules of Engagement and test plans
• Identify and exploit vulnerabilities in network infrastructure, operating systems, web applications, and databases
• Participate in red team and blue team exercises in simulated environments
• Execute attack scenarios and document findings
• Document all testing activities, findings, and exploitation paths in Penetration Test Reports (PTRs)
• Perform regression penetration tests to validate remediation of previously identified vulnerabilities
• Support aircraft cyber testing activities including avionics and flight system security assessments when directed
• Support specialized assessments of edge devices, firewalls, load balancers, and other network infrastructure components
• Assess and document the potential for lateral movement when access is gained during testing
• Report high-risk findings immediately
• Maintain and update penetration testing tools and lab environments
• Ensure all tools are FAA-approved prior to use
• Support the Penetration Testing Lead in developing Rules of Engagement and test plans for upcoming engagements

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, Mathematics, or Physics from an accredited institution
• Minimum of five (5) years of hands-on penetration testing experience, including network, system, and web application testing
• At least 2 years of relevant experience must be recent (performed within the last 3 years)
• Proficiency with Metasploit, Burp Suite, nMap, and related penetration testing frameworks
• Experience working within formal Rules of Engagement and producing structured penetration test reports
• Understanding of network protocols, routing, switching, firewall configurations, and common misconfigurations
• Experience with web application testing following OWASP methodology
• Ability to obtain and maintain a Public Trust security clearance
• At least one Red Teaming certification: OSCP, OSCE, OSWP, OSWE, CEH, ECSA, CEH Practical, ECSA Practical, LPT Master, GCIH, GPEN, GWAPT, GXPN, or GAWN