Penetration Tester

Tharros is hiring a Penetration Tester to support cyber test and evaluation missions in San Antonio, TX (onsite). In this role, you will help assess threats and vulnerabilities through authorized penetration testing, then translate findings into actionable audit reports that support risk and compliance-driven security auditing.

Responsibilities

• Analyze cyber defense policies and configurations to evaluate compliance with regulations and organizational directives.
• Assess software applications to understand system and mission context, identify mission-relevant vulnerabilities and exploits, and support authorized testing activities.
• Develop and test exploits for exposed vulnerabilities with a focus on non-interference of mission partner systems and networks.
• Conduct and/or support authorized penetration testing on enterprise network assets.
• Maintain a deployable cyber defense audit toolkit, including specialized cyber defense software and hardware, to support cyber defense audit missions.
• Maintain current knowledge of applicable cyber defense policies, regulations, and compliance documentation for cyber defense auditing.
• Prepare audit reports that document technical and procedural findings and recommend remediation strategies and solutions.
• Support required reviews within the environment, including Technical Surveillance, Countermeasure Reviews (TSCM), and TEMPEST countermeasure reviews.
• Perform technical and nontechnical risk and vulnerability assessments across focus areas such as local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications.
• Recommend cost-effective security controls to mitigate risk across protections for information, systems, and processes.
• Support customer assessments with travel up to 25%, including assignments lasting 1 to 4 weeks.

Requirements

• Current Top Secret clearance with SCI eligibility.
• Bachelor’s degree in a related field and minimum 8-12 years of experience providing related penetration testing services.
• IAT Level III certification required (examples include CASP, CISSP+, CISA, etc.).
• Experience and working knowledge of computer networking concepts and protocols, and network security methodologies.
• Understanding of risk management processes (assessing and mitigating risk) and how laws, regulations, policies, and ethics relate to cybersecurity and privacy, including operational impacts of cybersecurity lapses and application vulnerabilities.
• Knowledge of cryptography and cryptographic key management, data backup and recovery, and host/network access control mechanisms (for example, access control lists and capabilities lists).
• Knowledge of cybersecurity and privacy principles and organizational requirements for confidentiality, integrity, availability, authentication, and non-repudiation.
• Knowledge of network access and identity and access management (for example, public key infrastructure, OAuth, OpenID, SAML, SPML) and how traffic flows across networks using TCP/IP, plus related frameworks such as the OSI model and IT service concepts such as ITIL.
• Knowledge of programming language structures and logic, system and application security threats and vulnerabilities (including buffer overflow, cross-site scripting, PL/SQL and injections, race conditions, covert channels, replay, and return-oriented attacks, as well as malicious code).
• Knowledge of systems diagnostic tools and fault identification techniques, including what constitutes a network attack and how it relates to threats and vulnerabilities.
• Understanding of interpreted and compiled languages, classes of attacks (passive, active, insider, close-in, distribution attacks), and cyber attacker profiles (script kiddies, insider threat, non-nation state sponsored, nation sponsored).
• Knowledge of cyber-attack stages (reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
• Knowledge of network security architecture, topology, protocols, components, defense-in-depth concepts, and security models such as Bell-LaPadula, Biba, and Clark-Wilson.
• Knowledge of ethical hacking principles and data backup and restoration concepts, plus systems administration concepts for Unix/Linux, IOS, Android, and Windows.
• Knowledge of information classification programs and procedures for handling information compromise, including packet-level analysis with tools such as Wireshark and tcpdump.
• Penetration testing principles, tools, and techniques aligned to an organization’s threat environment, including application security risks such as the OWASP Top 10.
• Skill in conducting vulnerability scans, recognizing vulnerabilities, and assessing robustness of security systems and designs.
• Ability to detect host and network-based intrusions using intrusion detection technologies such as Snort.
• Experience mimicking threat behaviors and using penetration testing tools and techniques, including social engineering techniques (for example, phishing, baiting, tailgating).
• Use of network analysis tools to identify vulnerabilities (for example, fuzzing, nmap), plus reviewing logs for evidence of past intrusions and conducting application vulnerability assessments.
• Ability to perform impact and risk assessments and develop insights about an organization’s threat environment.
• Ability to translate security and privacy principles into organizational requirements and identify systemic security issues based on analysis of vulnerability and configuration data.
• Capability to share meaningful insights from programming and code review activities that improve an organization’s risk management posture.

Relevant Technologies

CASP, CISSP+, CISA, TCP, IP, OSI, ITIL, OAuth, OpenID, SAML, SPML, PL/SQL, Unix/Linux, IOS, Android, Windows, Wireshark, tcpdump, Dynamic Host Configuration, DNS, Snort, fuzzing, nmap, OWASP Top 10, Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model, access control list, capabilities lists, TCP/IP, ITIL (current version).