Penetration Tester

Koniag Government Services seeks a Penetration Tester to support authorized cybersecurity assessment initiatives for KOS and a government customer in Washington, DC (hybrid).

Responsibilities

• Conduct authorized penetration testing on networks, web applications, mobile applications, and infrastructure to uncover security weaknesses.
• Perform vulnerability assessments and attempt exploitation of identified vulnerabilities in a controlled, authorized manner.
• Develop and execute test plans covering reconnaissance, scanning, exploitation, and post-exploitation activities.
• Use industry-standard tools and techniques, including Metasploit, Burp Suite, and Nmap (as well as Nessus) to evaluate system security.
• Write custom scripts and tools to automate testing and support exploit development when needed.
• Produce detailed technical reports with risk ratings, exploitation methods, and remediation recommendations.
• Communicate findings and recommendations to technical teams and leadership in an actionable format.
• Collaborate with system administrators, developers, and security teams to validate and remediate vulnerabilities.
• Support social engineering assessments, including phishing campaigns, when required.
• Maintain awareness of emerging threats, attack vectors, and current penetration testing methodologies.
• Participate in red team / blue team exercises and support purple team collaboration efforts.
• Ensure all testing activities follow rules of engagement, legal requirements, and organizational policies.
• Support continuous monitoring and enterprise-wide security assessment activities.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field from an accredited institution; equivalent experience may be considered in lieu of a degree.
• 3-5 years of experience in penetration testing, ethical hacking, or offensive security roles.
• Demonstrated experience conducting network, web application, and/or wireless penetration tests.
• Experience using scripting languages such as Python, Bash, or PowerShell for tool development and automation.
• Exceptional communication skills (written and oral) to translate complex technical findings into actionable recommendations for technical and non-technical stakeholders.
• Strong understanding of networking protocols, Windows and Linux operating systems, and system architectures.
• Hands-on experience with penetration testing tools, including Metasploit, Burp Suite, Nmap, Wireshark, and Kali Linux.
• Knowledge of vulnerability frameworks: OWASP Top 10, MITRE ATT&CK, and CVSS scoring.
• Experience performing both internal and external penetration tests.
• Ability to think creatively and use an attacker mindset to identify non-obvious weaknesses.
• Strong grasp of security concepts, including encryption, authentication, and access control mechanisms.
• Ability to work independently and manage multiple engagements under tight deadlines.
• Strong report writing skills with attention to detail and accuracy.
• Ability to obtain and maintain a Public Trust Clearance.

Technologies

• Metasploit
• Burp Suite
• Nmap
• Nessus
• Python
• Bash
• PowerShell
• Wireshark
• Kali Linux
• OWASP Top 10
• MITRE ATT&CK
• CVSS
• Windows
• Linux
• AWS
• Azure
• GCP
• SAST
• DAST
• NIST 800-53
• FedRAMP
• RMF
• Kubernetes

Benefits

• Medical, dental, and vision insurance
• 401(k) retirement plan
• Paid time off
• Paid parental leave
• Life and disability insurance
• Flexible spending accounts
• Commuter benefits
• Tuition reimbursement

Preferred / Desired Skills

• Experience supporting federal government IT environments for security assessments.
• Industry certifications such as OSCP, GPEN, CEH, or CISSP.
• Experience with cloud security assessments (AWS, Azure, GCP).
• Familiarity with red team operations and adversary emulation techniques.
• Knowledge of secure coding practices and application security testing (SAST/DAST).
• Experience with container and Kubernetes security testing.
• Familiarity with compliance frameworks such as NIST 800-53, FedRAMP, or RMF.

Location: Washington, DC (hybrid). Salary: USD 140,000 - 165,000 per year.