Penetration Tester / Active Secret

Peraton is seeking an experienced Cyber Penetration Tester to support Federal Strategic Cyber programs. This hybrid role in Arlington, VA will partner with a Red Cell Team to conduct penetration testing, identify vulnerabilities, recommend remediation aligned to NIST 800-53, and help maintain and extend Red Cell infrastructure and tooling.

Role Overview

This position supports Red Cell activities through penetration testing, vulnerability identification, and remediation recommendations. Work includes reporting findings to system owners and engineers, and contributing to Red Cell infrastructure and automation efforts. Alignment with security controls and assessment expectations is required, including NIST 800-53 and related assessment methodologies.

Responsibilities

• Support the Red Cell Team by performing and leading penetration tests to assess the security posture of customer systems.
• Identify vulnerabilities and develop remediation recommendations to satisfy mandated NIST 800-53 security controls.
• Report and demonstrate findings to system owners and engineers.
• Maintain Red Cell infrastructure.
• Develop or modify tools to automate discovery or exploitation.

Required Qualifications

• Bachelor’s degree and 9 years of experience, or Master’s degree and 7 years of experience; in lieu of a degree, 4 years of additional experience may be considered.
• Minimum of 2 years with penetration testing experience.
• Possess one of the following certifications, or be able to obtain prior to the start date: CASP+ CE, CCNA Cyber Ops, CCNA-Security, CCNP Security, CEH, CFR, CISA, CISSP (or Associate), Cloud+, CySA+, GCED, GCIA, GCIH, GICSP, SCYBER.
• Demonstrated experience with Kali Linux.
• Demonstrated penetration testing tools experience with Nmap, Burp Suite, Metasploit, etc.
• Demonstrated ability evaluating vulnerabilities, performing root cause analysis, and reporting findings using assessment methodologies such as NIST SP 800-115, PTES, ISSAF, OWASP WTG, and related standards.
• Demonstrated ability to lead a penetration test and guide Senior/Junior Penetration Testers.
• U.S. citizenship required.
• Active Secret security clearance required.
• Ability to obtain a final Top Secret security clearance.

Technology and Tools

• Kali Linux, Nmap, Burp Suite, Metasploit
• NIST SP 800-115, PTES, ISSAF, OWASP WTG, NIST 800-53, NIST RMF
• Assessment and Authorization (A&A) process
• CASP+, CCNA Cyber Ops, CCNA-Security, CCNP Security, CEH, CFR, CISA, CISSP (or Associate), Cloud+, CySA+, GCED, GCIA, GCIH, GICSP, SCYBER, OSCP, CPTS, PNPT, GXPN, Zero Point Security Red Team Ops II
• Bash, Python, PowerShell, JavaScript, SSH, FTP, SMTP, SMB, HTTP
• IP routing, TCP/UDP, VPNs, firewalls, NAT
• XSS, SQLi, LFI

Location and Employment Details

• Location: Arlington, VA (hybrid)
• Target salary range: USD 86,000 to 138,000 per year
• Application period: estimated 30 days from the job posting date
• On-site expectations: Northern VA hybrid role; flexible provided the candidate can come on-site as needed

Benefits

• Medical, dental, vision
• Life and health savings account
• Short-term and long-term disability
• EAP
• Parental leave
• 401(k)
• Paid time off (PTO) for vacation
• Company-paid holidays

Program Overview

The Federal Strategic Cyber program provides technical, engineering, data analytics, cyber security, management, operational, logistical, and administrative support for the Bureau of Diplomatic Security, Cyber and Technology Security Directorate. Support spans three key areas: Cyber Monitoring and Operations, Cyber Threat and Investigations, and Technology Innovation and Engineering State.

Additional Application and Interview Information

• During application review, candidates may be required to participate in an on-camera interview and a process to verify identity.
• Use of artificial intelligence (AI) tools of any kind during Peraton interviews is strictly prohibited unless prior written authorization has been obtained.
• All interview responses must be the candidate’s own.

Preferred Qualifications

• Active Top Secret or TS/SCI clearance.
• Additional certification preference: CompTIA CASP+, ISC2 CISSP, ISC2 CCSP, or ISC2 ISSEP (or alternate verifiable certification demonstrating IT security competence).
• Penetration testing certification preference: OSCP, CPTS, PNPT, GXPN, or Zero Point Security Red Team Ops II (or alternate verifiable certification demonstrating practical penetration testing competence).
• Advanced understanding of NIST RMF and the A&A process.
• Advanced understanding of security principles (including CIA, access control models, risk management).
• Advanced understanding of networking principles such as IP routing, TCP/UDP, VPNs, firewalls, and NAT.
• Advanced understanding of common network protocols such as SSH, FTP, SMTP, SMB, and HTTP.
• Advanced understanding of operating system principles and data processing concepts (including encoding, hashing, encryption).
• Advanced understanding of scripting and programming languages such as Bash, Python, PowerShell, and JavaScript.
• Advanced understanding of common application vulnerabilities and common web application vulnerabilities (including XSS, SQLi, LFI).
• Advanced understanding of Active Directory enumeration and attacks, including kerberoasting, AS-REP roasting, misconfigured privilege abuse, and golden ticket development.
• Advanced understanding of PKI and navigating environments implementing multifactor authentication.
• Advanced understanding of cloud technologies including AWS, Microsoft Azure, and Google Cloud Platform.