Penetration Tester

About This Role

This role supports authorized cybersecurity assessment initiatives for KOS and a government customer. It involves conducting penetration testing on various systems, performing vulnerability assessments, and developing test plans. The ideal candidate will have experience with industry-standard tools and an attacker mindset to identify security weaknesses.

Responsibilities

• Conduct authorized penetration testing on networks, web applications, mobile applications, and infrastructure to uncover security weaknesses
• Perform vulnerability assessments and attempt exploitation of identified vulnerabilities in a controlled, authorized manner
• Develop and execute test plans covering reconnaissance, scanning, exploitation, and post-exploitation activities
• Use industry-standard tools and techniques, including Metasploit, Burp Suite, and Nmap (as well as Nessus) to evaluate system security
• Write custom scripts and tools to automate testing and support exploit development when needed
• Produce detailed technical reports with risk ratings, exploitation methods, and remediation recommendations
• Communicate findings and recommendations to technical teams and leadership in an actionable format
• Collaborate with system administrators, developers, and security teams to validate and remediate vulnerabilities
• Support social engineering assessments, including phishing campaigns, when required
• Maintain awareness of emerging threats, attack vectors, and current penetration testing methodologies
• Participate in red team / blue team exercises and support purple team collaboration efforts
• Ensure all testing activities follow rules of engagement, legal requirements, and organizational policies
• Support continuous monitoring and enterprise-wide security assessment activities

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field from an accredited institution; equivalent experience may be considered in lieu of a degree
• 3-5 years of experience in penetration testing, ethical hacking, or offensive security roles
• Demonstrated experience conducting network, web application, and/or wireless penetration tests
• Experience using scripting languages such as Python, Bash, or PowerShell for tool development and automation
• Exceptional communication skills (written and oral) to translate complex technical findings into actionable recommendations for technical and non-technical stakeholders
• Strong understanding of networking protocols, Windows and Linux operating systems, and system architectures
• Hands-on experience with penetration testing tools, including Metasploit, Burp Suite, Nmap, Wireshark, and Kali Linux
• Knowledge of vulnerability frameworks: OWASP Top 10, MITRE ATT&CK, and CVSS scoring
• Experience performing both internal and external penetration tests
• Ability to think creatively and use an attacker mindset to identify non-obvious weaknesses
• Strong grasp of security concepts, including encryption, authentication, and access control mechanisms
• Ability to work independently and manage multiple engagements under tight deadlines
• Strong report writing skills with attention to detail and accuracy
• Ability to obtain and maintain a Public Trust Clearance

Nice to have:

• Experience supporting federal government IT environments for security assessments
• Industry certifications such as OSCP, GPEN, CEH, or CISSP
• Experience with cloud security assessments (AWS, Azure, GCP)
• Familiarity with red team operations and adversary emulation techniques
• Knowledge of secure coding practices and application security testing (SAST/DAST)
• Experience with container and Kubernetes security testing
• Familiarity with compliance frameworks such as NIST 800-53, FedRAMP, or RMF

Benefits

• Medical, dental, and vision insurance
• 401(k) retirement plan
• Paid time off
• Paid parental leave
• Life and disability insurance
• Flexible spending accounts
• Commuter benefits
• Tuition reimbursement

About the Company

Koniag Government Services seeks to support authorized cybersecurity assessment initiatives for KOS and a government customer.