Penetration Tester (Red Team/Cyber Range)

Konane is seeking a senior Cyber Red Team Operator to support on-net adversarial threat emulation and penetration testing in the Department of Defense National Cyber Range Complex (NCRC). This role operates on-site at the Naval Air Station Patuxent River, Maryland, helping test and evaluate platform IT and networks while also supporting realistic training and certification events for the DoD Cyber Mission Force.

As part of this effort, you will coordinate closely with a government customer to perform assessments across aeronautical platform components and connected enterprise environments. Work centers on identifying weaknesses in operational networks and programs, using advanced testing concepts and tactics to emulate real-world adversary behavior.

Role & Responsibilities

• Partner with the government customer to conduct adversarial threat emulation (Red Teaming) and penetration testing to assess platform IT, subsystems, and equipment.
• Perform Red Teaming and penetration testing assessments against government networks, including Windows domains, Linux systems, and network devices such as switches and routers.
• Apply and/or develop highly advanced principles, concepts, and tactics.
• Identify issues and vulnerabilities associated with operational networks and programs.

Required Qualifications

• At least 10 years of pen testing, red team operations, and/or offensive security experience, including conducting on-net assessments.
• Experience using open source and commercial tools, including Metasploit, Burp Suite, Cobalt Strike, NMAP, and Core Impact.
• Working knowledge of IP network protocols and core networking concepts such as subnetting, routing, and switching.
• Penetration testing experience across modern Windows and Linux operating systems and IP-based networks.
• Experience with exploit and malware development targeting modern operating systems and defenses.
• Experience with reverse engineering.
• Web application penetration testing experience.
• Software development experience.
• Hardware hacking experience.
• Experience related to cryptography, software defined networks, and digital forensics.
• Experience related to control systems and Radio Frequency (RF).
• Ability to work effectively in a diverse team environment.
• Industry certification of EC-Council Certified Ethical Hacker (C|EH) and ISC2 Certified Information Systems Security Professional (CISSP) (or equivalents) is required.
• Obtain one or more of the following vendor certifications within 6 months of being hired:
  • Offensive Security Certified Engineer (OSCE)
  • Offensive Security Certified Professional (OSCP)
  • GIAC Certified Exploit Researcher and Advanced Penetration Testers (GXPN)

Technologies

• Metasploit, Burp Suite, Cobalt Strike, NMAP, Core Impact
• Windows domains, Linux systems
• Subnetting, routing, switching
• EC-Council Certified Ethical Hacker (C|EH), ISC2 Certified Information Systems Security Professional (CISSP)
• Offensive Security Certified Engineer (OSCE), Offensive Security Certified Professional (OSCP)
• GIAC Certified Exploit Researcher and Advanced Penetration Testers (GXPN)

Clearance, Location, and Travel

• Work location: In person at the Patuxent River, Maryland site.
• Ability to relocate: Naval Air Station Patuxent River, MD 20670 (Relocation before starting work is required).
• Clearance: All applicants must hold a current Top-Secret clearance or be able to obtain and maintain SCI eligibility; the clearance process considers financial background aspects.
• Travel: Up to 10% to CONUS sites as required.

Compensation & Benefits

• Pay: USD 140,600 - 210,000 per year
• Relocation assistance
• Health, life, disability
• Retirement plans
• Paid time off
• Opportunities for professional growth
• Tuition assistance

Additional Experience and Desired Qualifications

• Required experience: Cyber Red Team (5 years), Penetration testing (7 years)
• Clearance preference: Secret (Preferred)
• Cyber related military training courses such as Title 10 Interactive On-Net Operator Course, Joint Cyber Analysis Course (JCAC), and Cyber Operations Specialist Qualification Course.
• Industry certification of OSCP is highly desirable.
• Web application penetration testing specialization is a plus.
• WiFi and/or Software Defined Radio (SDR) hacking is a plus.
• Experience with red team/adversarial emulations is a plus.
• Experience executing Close Access Team (CAT) assessments is a plus.
• Experience with weapon systems assessments is a major plus.
• Bash scripting, Python, and/or PowerShell is a major plus.
• Experience working in a cyber range is a major plus.

Application Notes

• Question: What are your annual salary expectations from this role?
• Question: Are you willing to work on-site for this role?