Lead Penetration Tester

Join a security focused team in Washington, DC on site, with a competitive salary range of USD 110,000 - 150,000 per year. This Lead Penetration Tester role centers on end-to-end operational security assessments and web application testing across a federal agency portfolio, delivering test plans, detailed reports, and executive briefings aligned with ISC, OWASP, NIST, DISA STIG, and FedRAMP guidance. Expect a focus on impactful work, professional growth, and a collaborative culture that values precision and accountability.

Responsibilities

• Lead operational security assessments for federal agencies following the ISC Security Assessment Methodology and engagement rules, managing about 6–7 assessments annually.
• Perform web application security testing using the OWASP approach, evaluating roughly 3–4 applications each year across varied agency environments.
• Develop comprehensive test plans that define scope, objectives, methodology, engagement rules, and timelines for each engagement.
• Construct criticality matrices to rank findings by risk, asset value, and mission impact to guide remediation planning.
• Write thorough security assessment reports with findings, evidence, risk ratings, and actionable remediation guidance that meet federal standards.
• Deliver out-briefs to agency CIOs, CISOs, and senior leadership, translating complex findings into clear, executive-level insights.
• Lead FedRAMP qualified penetration testing in support of cloud service authorization, adhering to FedRAMP requirements and documentation standards.
• Apply NIST SP 800-series guidance and DISA STIG methodology throughout planning, execution, and reporting.
• Coordinate with agency stakeholders before, during, and after assessments to manage expectations and ensure findings are understood and acted upon.
• Stay current on vulnerability research, offensive techniques, and new attack surfaces relevant to federal civilian environments.

Requirements

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience.
• At least 5 years of hands-on penetration testing experience with demonstrated leadership of assessments in federal environments.
• CISA AES certification required, or actively pursuing it.
• FedRAMP penetration testing experience required.
• Active Secret clearance.
• Willingness to travel to agency sites as needed.
• Proven ability to conduct operational security assessments per the ISC methodology and federal rules of engagement.
• Proficiency applying OWASP methodology to web application security across federal environments.
• Working knowledge of NIST SP 800-series guidance for security assessment planning, execution, and reporting.
• Experience applying DISA STIG methodology to assessment scope and findings documentation.
• Experience developing test plans, criticality matrices, and security assessment reports that meet federal evidentiary and leadership reporting standards.
• Experience presenting technical security findings to CIO, CISO, and senior agency leadership audiences.
• FedRAMP-qualified penetration testing experience with familiarity of FedRAMP pen test requirements, documentation, and cloud authorization processes.
• Proficiency with industry-standard penetration testing toolsets for networks, applications, and infrastructure.

Technologies

• ISC Security Assessment Methodology
• OWASP
• NIST SP 800-series
• DISA STIG
• FedRAMP

Certifications

• Required: CISA AES (Authorized External Security) Assessment Lead or Technical Lead certification, or actively in process
• Strongly preferred: GPEN, GXPN, OSCP, or equivalent offensive security credential
• Strongly preferred: GWAPT or equivalent web application security certification

Nice to have differentiators

• Experience leading CISA AES assessments across multiple federal civilian agencies
• Familiarity with FedRAMP High, Moderate, and Low boundaries and their penetration testing implications
• Red Team operations or adversary emulation experience in addition to standard assessments
• Cloud-native application security assessment experience (AWS, Azure, GCP, or GovCloud)
• Active TS/SCI clearance

Project description

This role directs operational security assessments and penetration testing across a portfolio of federal agencies and web applications, delivering findings to CIO and CISO leadership. It also supports FedRAMP qualified testing for cloud service authorizations.

Position description

In this Lead Penetration Tester position, you own end-to-end execution of assessments and web application tests for federal clients, developing test plans, leading technical work, producing reports and matrices, and presenting to CIO and CISO audiences. You serve as the senior technical authority on engagements you lead.