Norfolk, VA

Cybersecurity Jobs in Norfolk, VA

15 jobs found

Include remote jobs

Today

Penetration Tester

Tharros Norfolk, VA

Norfolk, VA

Today

Full time Cybersecurity Tools Data Security Information Security

Apply Now

Job Description

Tharros is seeking a Penetration Tester to support the US Navy with operational test and evaluation (OT&E) support. This onsite role focuses on planning and conducting cyber tests, performing authorized penetration and access activities, and producing reporting deliverables for OPTEVFOR’s cyber OT&E mission.

Role Overview

The Penetration Tester will conduct cyber testing across operational systems, laboratory environments, or cyber range environments. Work includes authorized penetration or access of targeted networks and systems, along with activities to support test planning, execution, and results reporting.

Responsibilities

Assist in the development of cyber test plans.
Execute cyber tests aligned to assigned objectives.
Report cyber test results in support of operational test and evaluation needs.
Conduct cyber tests on operational systems, laboratory environments, and cyber range environments.
Perform on-net and off-net activities to control and exfiltrate data from deployed, automated technologies.
Conduct open-source data collection using various online tools.
Survey computer and digital networks to support target understanding.
Analyze target operational architecture to identify potential access paths.
Conduct network scouting and vulnerability analyses of systems within a network.
Deploy tools to targets and use them after deployment (for example, backdoors and sniffers).
Exploit network devices, security devices, and/or terminals or environments using various methods or tools.
Facilitate access via physical and/or wireless means.
Identify points of strength and vulnerability within a network.

Requirements

Minimum 1 year of experience performing any combination of penetration testing, red teaming, or exploitation development.
Certified Ethical Hacker (CEH), or equivalent, or higher certification.
Proficient in at least one offensive tool: Metasploit, Cobalt Strike, or Core Impact.
Ability to independently operate to conduct penetration testing/red teaming under the guidance of a senior or mid red team operator to accomplish assigned test objectives.
Ability to independently generate red team report documents.
Proficient in Microsoft Office Suite, including Teams or similar workplace chat and videoconferencing tools.
Excellent written and verbal communication skills.

Tools and Technologies

Metasploit
Cobalt Strike
Core Impact
Microsoft Office Suite
Teams

View full job page →

Today

Senior Penetration Tester

Tharros Norfolk, VA

Norfolk, VA

Today

Full time Senior Cybersecurity Penetration Testing Cybersecurity Tools

Apply Now

Job Description

Tharros is seeking a Senior Penetration Tester to support US Navy operational test and evaluation efforts from Norfolk, VA (onsite). In this role, you will help strengthen cyber test coverage by building test plans, executing penetration testing and red team activities across operational and lab environments, and delivering clear results for mission-focused OT and cyber OT&E.

Responsibilities

Review and become proficient in OPTEVFOR cyber T&E concept of operations, SOPs, policies, and guidance.
Maintain and participate in the development of 01D SOPs and documentation for DCAT authorization established in DoDI 8585.01.
Research, review, prioritize, and submit operational requirements for acquisition of equipment or cyber capabilities through the 01D tool approval process.
Support development and execution of TTPs for penetration testing and Red Teaming.
Research adversary cyber actors’ TTPs, organizational structures, capabilities, personas, and environments, then integrate findings into cyber survivability test planning and execution.
Participate in OPTEVFOR Cyber Test planning by conducting open-source research and reviewing systems under test documentation to identify attack surface and threat vectors across operational, lab, and cyber range environments, including physical, virtualized, and cloud-based systems.
Participate in checkpoint meetings and help guide development of test plan objectives; review test plans to ensure objectives are feasible.
Support test preparation activities, including site pre-test coordination visits and in-briefs to the test site.
Lead red team test plan review and add relevant system technical information to the test reference library.
Organize and lead research presentations for advanced capability development supporting future tests; prepare OPTEV-RT test assets (Government Furnished).
Execute test events, including Cooperative Vulnerability Penetration Assessments, Adversarial assessments, and Cyber Tabletops, in support of Operational Testing, Developmental Testing, risk reduction events, or other assigned events.
Use OPTEVFOR-provided and NAO-approved commercial and open-source network cyber assessment tools (e.g., Core Impact, Nmap, Burp, Metasploit, and Nessus).
Apply ethical hacking expertise to exploit discovered vulnerabilities and misconfigurations across operating systems (Windows, Linux), protocols (HTTP, FTP), and network security services (PKI, HTTPS) to meet test objectives.
Independently accomplish testing and provide direction to basic and intermediate operators.
Ensure tests are conducted safely in accordance with the test plan and OPTEVFOR policies, and follow JFHQ-DODIN deconfliction procedures.
Verify collected data for accuracy and completeness; participate in post-test iterative processes, including generation of deficiency/risk sheets, and document lessons learned.
Participate in capture the flag events, cyber off sites, and external engagements such as red team huddles and red team technical exchange meetings, producing required materials.
Attend OPTEVFOR required meetings supporting OT&E and generate/update documentation to maintain DCAT authorization compliance per DoDI 8585.0.

Requirements

Minimum 6 years experience performing any combination of penetration testing, red teaming, or exploitation development.
Minimum 6 years leading red team operators in penetration testing/red teaming to accomplish assigned test objectives.
Required certifications: OSCP, OSCE, GX-PT, GXPM, PNPT, or HTB CPTS.
Proficient with offensive tools including Metasploit, Cobalt Strike, Core Impact, Burp Suite, Nessus, and SharpHound/BloodHound.
Ability to validate the functionality and safety of offensive tools (e.g., exploits) using source code and document results.
Ability to detect malicious activity using dynamic analysis techniques and document results.
Ability to independently operate to conduct penetration testing/red teaming to achieve assigned objectives.
Proficient in Microsoft Office Suite, including Teams or similar workplace chat and videoconferencing tools.
Excellent written and verbal communication skills.

Technologies

Core Impact, Nmap, Burp, Metasploit, Nessus
Cobalt Strike, Burp Suite, SharpHound/BloodHound
Windows, Linux
HTTP, FTP, PKI, HTTPS
Microsoft Office Suite, Teams

View full job page →

5d ago

Information Systems Security Engineer

MANTECH Norfolk, VA

Norfolk, VA

5d ago

Full time Engineer Information Security InfoSec

Apply Now

Job Description

MANTECH is seeking an onsite Information Systems Security Engineer (ISSE) to support the Navy Continuous Training Environment (NCTE) Program in Norfolk, Virginia. This role centers on security assessments, security requirement validation, security architecture and component development, and compliance with RMF and related authorization activities.

Responsibilities

Perform, support, or review security assessments to identify vulnerabilities or non-compliance, and recommend mitigation or threat-elimination activities.
Validate and verify complex, system-wide security requirements using analysis of user needs, policy, regulatory requirements, and resource demands.
Design, develop, and deploy security system architectures to align with evolving customer needs.
Design, develop, implement, and/or integrate security components, including capabilities for networking, computing, and multi-enclave environments.
Support the development and implementation of security functionality across a range of enterprise products and services.
Review, provide feedback, and help update and maintain program and project documentation that includes IS stipulations, such as system security plans (SSP), certification and accreditation (C&A) packages, and other system design artifacts.
Enforce compliance with security authorization activities in alignment with Government standards and the RMF.

Required Qualifications

Bachelor’s degree in Computer Science or other related technical field and 5+ years of relevant information systems experience, or an Associates degree and 8+ years of relevant information systems experience, or a High School Diploma and eleven 11+ years of information systems relevant experience in lieu of Bachelors degree.
Experience identifying and analyzing systems requirements.
Experience developing and maintaining system applications and security.
Experience providing user support and guidance.
Experience recommending and implementing security upgrades, security patches, and addressing vulnerabilities for installed equipment.
Experience ensuring proper documentation, coordination, and maintenance across multiple systems.
Experience with DIACAP and RMF; ACAS experience and DISA ACAS certification.
Experience with eMass.
Computing Environment/Operating System (CE/OS) certifications (preferably VMware, Linux, and/or Microsoft Windows 2022).

Technologies

DIACAP
RMF
ACAS
eMass
VMware
Linux
Microsoft Windows 2022

Preferred Qualifications

Relevant work experience as an ISSE within a U.S. Government environment, with DoD experience strongly preferred.
Active SEC+ CE certification.
Master’s degree in computer science or related technical field.
Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.

Clearance Requirements

US citizenship required and an active Secret security clearance.

Physical Requirements

Must be able to remain in a stationary position 50%.
Constantly operates a computer and other office productivity machinery, such as a calculator, copy machine, and computer printer.
Occasionally move about inside the office to access file cabinets and office machinery.

View full job page →

20d ago

Cybersecurity Analyst

AUSGAR Technologies Inc Norfolk, VA

Norfolk, VA

20d ago

$95k - $115k/yr Full time Information Security InfoSec Risk Management

Apply Now

Job Description

AUSGAR Technologies Inc is seeking a Cybersecurity Analyst to support Navy Warfare Development Center (NWDC) missions in Norfolk, VA in an onsite setting. This role serves as an Accreditation Analyst and Experiment Support Planner, acting as a cybersecurity subject-matter expert for down-selected initiatives with a focus on Assessment and Authorization (A&A), Risk Management Framework (RMF) planning, compliance activities, and security testing.

In this position, you will track and assist A&A efforts for technology providers, help engineering teams reach required accreditation milestones ahead of experiment participation, and support required documentation and testing artifacts used to prepare systems for naval environments.

Key Responsibilities

Track, monitor, and assist Assessment and Authorization (A&A) efforts for technology providers selected for operational experiments.
Support engineering teams in developing plans to achieve required accreditations in advance of experiment participation.
Analyze general information assurance-related technical problems and provide technical support to resolve them.
Develop and review Interim Authority to Test (IATT) plans for down-selected initiatives.
Develop and review a feasible Risk Management Framework (RMF) process with A&A points of contact (POCs) to align planning, installation, and execution milestones.
Create and maintain a timeline and tracker for RMF A&A package development.
Coordinate with the NAVWAR Navy Authorizing Official (NAO) and Security Control Assessor (SCA) Package Support Office to define IATT in-hand dates and accreditation termination dates for down-selected initiatives.
Conduct ACAS scanning and SCAP Testing, and perform manual STIG testing as required to support A&A package development.
Enter and update POA&M items, track action items for package development in eMASS, and identify outstanding action items for cyber POCs.

Required Qualifications

Active Secret Clearance, with ability to obtain a TS/SCI.
Must have IAT/IAM Level II certification, specifically Security+ CE.
Bachelor’s Degree in a technical field (example areas include Engineering, Physical Sciences, Math, or Management Information Systems) and 5+ years of Information Assurance operations experience.
2+ years of direct experience with RMF and related installation and accreditation processes.
Certainly align with cybersecurity analyst or ISSE-type experience.
Experience with eMASS, Navy RMF, ACAS/NESSUS, and SCAP.
Experience with compliance of current Navy IT and IA policies, including ship and ashore policy requirements.
Experience working with material solutions intended to connect to a Navy network, such as applications, networks, servers, or associated devices.
Knowledge of DoD Cybersecurity policies and procedures.
Knowledge of IA certifications and accreditations associated with the A&A process.
Knowledge of required A&A documentation prior to experiment events, including documentation for equipment installed on a naval vessel or aircraft.
Ability to identify cybersecurity architecture issues to meet Navy requirements, including review of RMF IATT artifacts.
Prior experimentation or test and evaluation experience is desired.
Minimal travel may be required, up to 5%.

Technology Areas

Security+ CE
eMASS
ACAS
NESSUS
SCAP
STIG
Risk Management Framework (RMF)
Interim Authority to Test (IATT)
Assessment and Authorization (A&A)
POA&M
Enterprise Mission Assurance Support Service (eMASS)

Salary

$95,000 - $115,000 per year.

Additional Notes

A Federal Government-issued security clearance is essential and may require successful completion of a background check.
Based on qualifications, the role may be placed in Level I-V.
E-Verify is used to electronically confirm employment eligibility of newly hired employees.
Salary range depends on factors including experience, skills, education, certifications, and geographical location, and includes base salary and an excellent benefits package.

View full job page →

23d ago

Cyber Security Analyst

Falconwood, Inc. Norfolk, VA

Norfolk, VA

23d ago

$130k - $140k/yr Full time Cybersecurity A&a Data Security Information Security

Apply Now

Job Description

Falconwood, Inc. is seeking a Cyber Security Analyst to support the USFF N6 Directorate Fleet Enterprise Support Team and the PSO in delivering end-to-end Risk Management Framework (RMF) Assessment & Authorization (A&A) support for Navy shore commands. The role focuses on overarching expertise for A&A, compliance validation, and the tracking and mitigation of physical, policy, and network security issues across mission-relevant systems.

Working onsite in Norfolk, VA, you will help ensure submitted A&A packages meet DoD and Navy Cybersecurity requirements, while also supporting risk assessment and accreditation decision milestones for Navy Authorizing Officials (NAOs).

Responsibilities

Review A&A package submissions to verify that system and network architectures, along with technical and non-technical operating features, adequately protect and defend against unauthorized access, support system availability, and satisfy DoD/Navy Cybersecurity implementation policy and data protection safeguards.
Perform CS compliance and A&A documentation validation assessments for Naval networks, legacy applications, and other systems.
Support the development and updates of existing A&A and CS documentation to ensure completeness in accordance with DoD A&A and CS policy.
Assist in developing procedures for A&A workflow processes, including criteria that support NAO accreditation decision milestones.
Contribute to trainings, presentations, briefings, and written documentation supporting A&A and CS functions as needed.
Help develop and maintain Standard Operating Procedures (SOPs), checklists, workflow process charts, and other documentation required for NAO processes and related A&A functions.
Support USFF subordinate commands with risk assessment related tasks such as discussing assessment results, documenting vulnerability status, and providing guidance and training across RMF topics.
Collaborate with motivated teammates and provide reciprocal support across the team.
Monitor and report the security posture for mission critical systems, including communicating risk and recommended mitigations.

Requirements

Information Assurance Technician (IAT) Level III qualifications (including CISSP, CISM, CASP, etc.).
Active DoD Secret clearance.
Minimum 5 years of experience in DoW/DoN Cybersecurity, Engineering, Test & Evaluation, or Assessment & Authorization (A&A).
Ability to provide technical support and apply expertise assessing information system compliance with DoN and Navy RMF standards, including review, verification, and validation of required DoD RMF documentation and artifacts in accordance with DoD Instruction 8510.01, the Navy SCA Risk Assessment Guide (RAG), and the Navy RMF Process Guide (RPG).
Demonstrated knowledge of DoD cybersecurity policies, procedures, and practices (including RMF and NIST SP 800-53) to achieve and maintain system accreditation and authorization.
Experience analyzing, summarizing, and reporting security vulnerabilities and weaknesses verbally and in writing to appropriate leadership.
Self-motivated with an understanding of technical concepts, strong communication skills, and the ability to collaborate on technical items.
Knowledge and experience using DoD tools and capabilities for vulnerability assessments and compliance reporting, including eMASS, ACAS, STIGs, SRGs, SCAP, and related capabilities.
Knowledge and experience with cybersecurity, information technology, and network architecture, including computers, operating systems (Linux and Windows-based), networks, network devices, deployment environments (such as data centers and cloud), and systems and application security threats and vulnerabilities.
Ability to perform quality assurance reviews for required A&A process package content in accordance with provided SOPs and checklists.
Proficiency with Microsoft Office (Word, Excel, PowerPoint).

Technologies

CISSP, CISM, CASP
DoD Instruction 8510.01
Navy SCA Risk Assessment Guide (RAG)
Navy RMF Process Guide (RPG)
RMF, NIST SP 800-53
eMASS, ACAS, STIGs, SRGs, SCAP
Linux, Windows-based
Microsoft Office (Word, Excel, PowerPoint)

Preferred

BS degree in Computer Science, Cyber Security, or a related technical field.
Minimum of 3 years of experience as a Navy Qualified Validator (NQV).
Experience training or instructing a small group with varied levels of experience.
Experience supporting information assurance for US Navy systems.
Experience performing information assurance for cloud environments (and/or cloud-related certification).

Pay Range

$130,000 - $140,000 per year.

View full job page →

1mo ago

Penetration Tester

Tharros Norfolk, VA

Norfolk, VA

1mo ago Closed

Full time Active Directory Cobalt Strike Cybersecurity Tools

This position is no longer accepting applications (closed Oct 28, 2026).

Job Description

Tharros is seeking a Penetration Tester to support the US Navy’s operational test and evaluation mission. This onsite role in Norfolk, VA focuses on building and executing cyber test plans across operational systems, lab environments, and cyber ranges, with reporting that feeds into the OPTEVFOR cyber OT&E mission. If you have hands-on offensive testing experience and enjoy structured, policy-driven test execution, this position offers a direct path to apply real-world penetration testing in support of operational evaluation.

Responsibilities

Review and build proficiency in OPTEVFOR cyber T&E concept of operations, SOPs, policies, and guidance.
Maintain and participate in the development of 01D SOPs and documentation for DCAT authorization established in DoDI 8585.01.
Research, review, prioritize, and submit operational requirements for acquisition of equipment or cyber capabilities using the 01D tool approval process.
Support development and execution of TTPs for penetration testing and Red Teaming.
Research adversary cyber actors’ TTPs, organizational structures, capabilities, personas, and environments, and integrate findings into cyber survivability test planning and execution.
Participate in OPTEVFOR cyber test planning, including:
- Open-source research and system-under-test documentation review to identify attack surface and threat vectors.
- Check point meetings, test plan objective development, and feasibility review of test plan objectives.
- Test planning site visits and site pre-test coordination visits, including in-brief support.
Support test preparation activities, including red team test plan review and adding system technical information to the test reference library.
Organize and support research presentations for advanced capability development in support of future tests.
Prepare OPTEV-RT test assets (Government Furnished).
Execute test events as assigned, including Cooperative Vulnerability Penetration Assessments, adversarial assessments, and cyber tabletops.
Use OPTEVFOR-provided and NAO approved commercial and open-source network cyber assessment tools (e.g., Core Impact, Nmap, Burp, Metasploit, and Nessus).
Apply ethical hacking knowledge to exploit discovered vulnerabilities and misconfigurations across operating systems (Windows, Linux), protocols (HTTP, FTP), and network security services (PKI, HTTPS) aligned to test objectives.
Conduct testing independently while ensuring safe execution, adherence to the test plan, and compliance with OPTEVFOR policies.
Follow JFHQ-DODIN deconfliction procedures.
Verify collected data for accuracy and completeness.
Participate in post-test iterative documentation (including deficiency and risk sheets) and document lessons learned.
Support OPTEVFOR-required engagements, including capture the flag events, cyber off sites, external engagements (e.g., red team huddles and technical exchange meetings), and creation of required products and materials.
Generate and update documentation to maintain DCAT authorization compliance per DoDI 8585.0.
Process exfiltrated data for analysis and/or dissemination to customers.
Test and evaluate locally developed tools for operational use and implementation.
Perform duties under the supervision of the 01D Cyber Operations Officer.

Requirements

Minimum 3 years experience performing any combination of penetration testing, red teaming, or exploitation development.
Minimum 3 years proficiency in leading red team operators in penetration testing/red teaming to accomplish assigned test objectives.
OSCP (or equivalent certification).
Proficient with offensive tools including Metasploit, Cobalt Strike, Core Impact, Burp Suite, Nessus, and SharpHound/BloodHound.
Ability to validate functionality and safety of offensive tools (e.g., exploits) given source code and to document results.
Ability to detect malicious activity using dynamic analysis techniques and document results.
Ability to independently operate to conduct penetration testing/red teaming to accomplish assigned test objectives.
Skills in assessing current tools for needed improvements and in knowledge management (including technical documentation such as Wiki pages).
Knowledge of current software and methodologies for active defense and system hardening.
Knowledge of encryption algorithms and cyber capabilities/tools (e.g., TLS, PGP).
Knowledge of evasion strategies and techniques; forensic implications of operating system structure and operations; host-based security products and how they affect exploitation and vulnerability.
Knowledge of network administration, network construction and topology, and security hardware/software options and their effects on exploitation.
Knowledge of security implications of software configurations and fundamentals of digital forensics to extract actionable intelligence.
Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations.
Knowledge of Unix/Linux and Windows operating systems structures and internals.
Knowledge of network collection procedures including decryption capabilities/tools, techniques, and procedures.
Ability to test and evaluate tools for implementation and proficiency with Microsoft Office Suite including Teams or similar workplace chat and videoconferencing tools.
Excellent written and verbal communication skills.

Technologies

Core Impact
Nmap
Burp
Metasploit
Nessus
Cobalt Strike
Burp Suite
SharpHound/BloodHound
Transport Layer Security
Pretty Good Privacy
Windows
Linux
HTTP
FTP
PKI
HTTPS
Microsoft Office Suite
Teams

View full job page →

1mo ago

Senior Principal Cyber Information Systems Security Engineer

SAIC Norfolk, VA

Norfolk, VA

1mo ago Closed

$160k - $200k/yr Full time Senior Cyber Security Engineer

This position is no longer accepting applications (closed Oct 19, 2026).

Job Description

SAIC is seeking a Senior Principal Cyber Information Systems Security Engineer to lead Risk Management Framework (RMF) package development, management, and authorization across both unclassified and classified environments. In this role, you will serve as a senior principal authority supporting the full RMF lifecycle, from initiation through authorization and continuous monitoring for DoD enterprise IT and network modernization efforts.

This position is based in Norfolk, VA (onsite) and supports concurrent authorization activities for multiple systems, with direct coordination across program, engineering, and government stakeholders to achieve and sustain Authority to Operate (ATO).

Key Responsibilities

Act as Senior Principal ISSE and subject matter expert responsible for leading development, management, and authorization of RMF packages across unclassified and classified environments supporting DoD enterprise IT and network modernization programs
Lead end-to-end RMF lifecycle activities aligned to NIST SP 800-39, 800-37, 800-53, 800-53A, and 800-137 for multiple simultaneous unclassified and classified systems
Categorize systems and information using FIPS 199 and NIST SP 800-60; select and tailor initial security control baselines using FIPS 200 and NIST SP 800-53
Implement security controls using NIST Special Publication guidance including 800-34, 800-64, and 800-128, and document implemented security controls in a functional manner
Assess security controls according to NIST SP 800-53A to verify correct implementation, intended operation, and achievement of desired outcomes
Manage and maintain eMASS records for assigned systems, ensuring accuracy and completeness of all RMF artifacts, POA&Ms, and authorization documentation across the system lifecycle
Drive RMF packages through the full authorization workflow in accordance with Navy and DoD RMF processes, coordinating with Authorizing Officials (AOs), Information System Owners (ISOs), and Program Managers to achieve and maintain ATO
Ensure continuous monitoring based on NIST SP 800-137, NIST SP 800-37, NIST SP 800-53A, and related special publications to maintain ongoing ATO compliance
Collaborate with engineering teams to identify, document, and implement security controls across complex DoD enterprise IT and network infrastructure environments
Perform internal auditing functions supporting ISO/IEC 9000, 20000, and 27001, and coordinate with external auditors to ensure actions meet industry standards
Conduct policy analysis to author or support authoring of new enterprise cybersecurity policy aligned with DoD and Navy security requirements
Provide expert technical guidance and mentorship to junior cybersecurity team members on RMF processes, eMASS management, and ATO authorization workflows
Serve as organizational spokesperson and prime ISSE technical contact for significant cybersecurity authorization matters requiring coordination between program teams, engineering organizations, and government stakeholders
Support business development through technical proposal development, capability demonstrations, and customer relationship management for program re-compete and growth opportunities

Required Qualifications

U.S. Citizen
Bachelor’s degree with 14+ years of related experience; Master’s degree with 12+ years; or PhD or JD with 9+ years
10+ years of hands-on ISSE and RMF experience with demonstrated senior principal-level contributions across complex DoD program authorization environments
Must have an Active Secret Clearance at start
Must be able to obtain TS/SCI after start
DoD 8570/8140 IAM Level III or IAT Level III certification required (CISSP, CISM, or equivalent)
CompTIA Security+ CE required at minimum
RMF lifecycle management experience covering NIST 800-37, 800-53, 800-53A, and 800-137
Experience with eMASS system management and ATO package development
Experience with FIPS 199/200 system categorization and security control selection
Experience with POA&M development, tracking, and remediation management
Experience with unclassified and classified system authorization workflows
Background in DoD enterprise IT and network infrastructure security