Metasploit

Metasploit Cybersecurity Jobs

47 jobs found

Today

Penetration Tester Senior

General Dynamics Information Technology Ashburn, VA

Ashburn, VA

Today

$143k - $170k/yr Full time Senior Cybersecurity Tools Data Security

Apply Now

Job Description

General Dynamics Information Technology is looking for a Senior Penetration Tester in Ashburn, VA (onsite) to support mission-critical cybersecurity operations. In this role, you will lead advanced penetration testing engagements, emulate real-world adversary behavior, and help drive vulnerability discovery, validation, and remediation through clear, actionable reporting. This position is based on BI Full 6C (T4) public trust and includes a salary range of USD 142,792 - 170,200 per year.

What you’ll do

Lead complex penetration testing engagements and provide guidance to junior and mid-level testers across scoping, tooling, exploitation techniques, documentation quality, and professional development.
Plan test approaches, conduct advanced exploitation, and deliver detailed reporting that supports corrective actions for critical systems.
Define objectives, rules of engagement, and test boundaries in partnership with system owners, ISSOs, engineering leads, and mission stakeholders.
Create tailored test plans that align with system architecture, threat scenarios, and compliance requirements.
Perform hands-on testing across network, application, wireless, and enclave targets using modern red-team methodologies to discover and validate exploitable weaknesses.
Use industry tools and frameworks including Nmap, Nessus, Metasploit, Burp Suite, CANVAS, and Kismet to enumerate, exploit, and confirm vulnerabilities at scale.
Develop proofs of concept, chained exploits, and post-exploitation procedures that demonstrate realistic impact and help system owners prioritize remediation.
Produce comprehensive technical reports with vulnerability descriptions, reproduction steps, affected assets, exploit evidence, and prioritized remediation recommendations for both engineering and executive audiences.
Present findings, defend methodologies, and translate technical risk into mission-aligned decisions during briefs and touchpoints.
Partner with developers, system engineers, SOC, and risk teams to recommend mitigation strategies and validate fixes during retesting cycles.

Required qualifications

Minimum 5 years of offensive security or penetration testing experience, including leading complex assessments and delivering authoritative reports.
Strong leadership and communication abilities.
Advanced proficiency with penetration testing tooling and exploitation techniques for network, application, and wireless vectors.
Strong technical writing and oral presentation skills that meet audit and executive communication standards.
Ability to collaborate with technical and non-technical stakeholders across federal and enterprise environments.
U.S. Citizenship Required.
Less than 10% travel.
A degree in cybersecurity, computer science, information technology, or a related field is preferred.

Preferred certifications

OSCP (highly valued)
GIAC Penetration Tester (GPEN)
CREST Registered Pen Tester (CRT)

Additional notes

Preferred: Previous or Current CBP Background Investigation.
Clearance level: None.
Public trust: BI Full 6C (T4).
Category: Cyber and IT Risk Management.
Technologies: Nmap, Nessus, Metasploit, Burp Suite, CANVAS, Kismet.

Identity verification process

Virtual interviews require you to be on camera.
The company reserves the right to take your picture to verify your identity and prevent fraud.
You authorize the collection, processing, and use of your biometric data for identity verification and security purposes.

View full job page →

Today

Penetration Tester Mid-Level

General Dynamics Information Technology Ashburn, VA

Ashburn, VA

Today

$108k - $129k/yr Full time Application Security Information Security InfoSec

Apply Now

Job Description

Onsite role in Ashburn, VA supporting CBP Cyber Security Directorate activities. This mid-level penetration testing position combines hands-on assessment work across a wide range of environments and the chance to drive meaningful improvements through documented findings and retesting cycles.

Compensation for the role is USD 107,744 - 129,375 per year. U.S. citizenship is required, and the position is designated with Public Trust: BI Full 6C (T4).

What you’ll do

Run hands-on penetration tests across networks, applications, endpoints, cloud workloads, and mission systems to identify exploitable security weaknesses.
Apply industry-standard offensive tooling to uncover issues such as misconfigurations, privilege escalation paths, insecure protocols, and application-level vulnerabilities.
Conduct both credentialed and non-credentialed testing, covering reconnaissance, enumeration, exploitation, post-exploitation analysis, and vulnerability validation.
Assess vulnerabilities for exploitability, impact, and potential operational risk, supporting clear prioritization decisions.
Analyze complex, cross-domain environments including hybrid cloud, containerized platforms, mobile, and legacy systems to identify security gaps.
Create detailed technical assessment reports that include vulnerability descriptions, exploitation steps, affected assets, and prioritized remediation recommendations.
Support follow-up assessments and retesting cycles to confirm remediation completeness and sustained risk reduction.

Tools you’ll use

Work will involve technologies such as Nmap, NESSUS, Metasploit, Burp Suite, CANVAS, and Kismet, along with other offensive frameworks as needed.

What you bring

3+ years of penetration testing or offensive security experience.
Strong understanding of exploit development concepts, offensive tooling, and common security control weaknesses.
Experience conducting network, application, and wireless assessments using modern red-team methodologies.
Ability to produce structured documentation with clear technical writing and effective communication to both technical and non-technical audiences.
Preferred certifications: CompTIA PenTest+, eJPT / eCPPT, OSCP (highly valued), GIAC Penetration Tester (GPEN).
Education preference: Bachelor’s degree in information technology, computer science, cybersecurity, or a related field.
Preferred: Previous or current CBP Background Investigation.

Work requirements & eligibility

Travel: Less than 10%
Citizenship: U.S. Citizenship Required
Clearance level: None listed
Public Trust: BI Full 6C (T4)

Identity verification

The hiring process may include virtual interview steps where you are expected to be on camera. The employer reserves the right to take a picture to verify your identity and help prevent fraud.

View full job page →

8d ago

Enterprise Cybersecurity Penetration Tester

Booz Allen Hamilton McLean, VA

McLean, VA

8d ago

$62k - $141k/yr Full time Active Directory Azure Cloud

Apply Now

Job Description

Booz Allen Hamilton offers a hands-on role with its internal Red Team, combining enterprise penetration testing with opportunities to share knowledge and support real-world remediation. You will work onsite in McLean, VA, helping evaluate security posture across enterprise networks, applications, endpoints, and cloud environments while partnering with offensive security reporting and consulting teams.

Compensation: The projected annual salary range is USD 62,000 - 141,000. Final offers are based on location, education, skills, competencies, experience, and contract or organizational requirements.

What you’ll do

Execute enterprise and system-focused network and penetration assessments.
Identify security risks across applications, controls, and infrastructure.
Collaborate with offensive security reporting teams on findings and analysis.
Partner with consulting teams to deliver security solutions and support enterprise cybersecurity efforts.
Evaluate established rules of engagement and system penetration testing requirements.
Document findings, support remediation efforts, and help promote an environment of innovation and knowledge sharing.
Communicate technical security concepts to both technical and non-technical stakeholders.
Contribute to security research and promote knowledge sharing across the team.

This is a fast-paced, technical role focused on evaluating security posture, producing high-quality documentation, and collaborating closely with offensive security reporting and consulting partners to deliver actionable security analysis.

What you bring

Experience with vulnerability enumeration and exploitation frameworks, including Burp Suite Pro and Metasploit.
Knowledge of foundational techniques for vulnerability discovery, enumeration, exploitation, and post-exploitation.
Ability to write technical findings into high-quality assessment reports.
Ability to effectively communicate with clients, teammates, and senior leadership.
Bachelor’s degree.
One or more offensive security certifications: OSCP, OSWA, OSEP, OSEE, PNPT, CRTO, GPEN, GWAPT, GCPN, GXPN, or Offensive Security Certification.

Tools and environments

Burp Suite Pro, Metasploit
Python, Golang
Active Directory, Azure, Amazon Web Services

Benefits

Health, life, disability, financial, and retirement benefits
Paid leave
Professional development
Tuition assistance
Work-life programs
Dependent care
Recognition awards program

Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs.

Additional details

Work model: Onsite (primarily full-time at a customer facility with direct collaboration as required).
Citizenship requirement: Due to the nature of work performed within this facility, U.S. citizenship is required.
Closing timeline: This posting will close within 90 days from the posting date.

Identity and interview policy

During the hiring process, you will be asked to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud.
You are expected to be on camera during interviews and assessments; Booz Allen reserves the right to take your picture to verify your identity and prevent fraud.
Candidate AI usage policy: The use of AI or other tools to assist with responses during interviews is prohibited unless permission is explicitly provided.

Non-discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran, or any other status protected by applicable federal, state, local, or international law.

View full job page →

8d ago

Enterprise Cybersecurity Penetration Tester

Booz Allen Hamilton McLean, VA

McLean, VA

8d ago

$87k - $198k/yr Full time Cybersecurity Tools Ethical Hacking Information Security

Apply Now

Job Description

Lead enterprise network and penetration testing in Booz Allen Hamilton’s internal Red Team environment.

Responsibilities

Plan, lead, and execute enterprise and system-focused network and penetration assessments
Assess and surface security risks across applications, controls, and infrastructure
Coordinate with offensive security reporting teams on findings and analysis
Partner with consulting teams to support delivery of security solutions
Evaluate established rules of engagement and system penetration testing requirements
Explain technical security concepts to both technical and non-technical stakeholders
Contribute to security research and promote knowledge sharing across the team

Requirements

2+ years of experience in penetration testing and red teaming
Experience with vulnerability enumeration and exploitation frameworks, including: Burp Suite Pro, Metasploit, Cobalt Strike, Armitage, or PowerSploit
Foundational knowledge of vulnerability discovery, enumeration, exploitation, and post-exploitation techniques
Ability to write high-quality technical assessment reports and communicate findings to clients and teammates
Ability to lead organized security testing engagements on a team
Bachelor’s degree
Relevant certification such as one or more: OSCP, OSWA, OSEP, OSEE, PNPT, CRTO, GPEN, GWAPT, GCPN, GXPN, or an Offensive Security certification

Technologies

Burp Suite Pro
Metasploit
Cobalt Strike
Armitage
PowerSploit

Benefits

Health, life, disability, financial, and retirement benefits
Paid leave
Professional development
Tuition assistance
Work-life programs
Dependent care
Recognition awards program
Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs

Nice If You Have

Experience with covert computer network exploitation or adversary emulation
Experience exploiting Active Directory, Azure, and Amazon Web Services
Knowledge of scripting languages, API functionality, and data access methodologies
Ability to operate in a fast-paced work environment, multitask, and handle delivery deadlines
Ability to clearly communicate technical details and vulnerability data to non-technical teammates and clients
Bachelor’s degree in Information Security, Cybersecurity, or CS

Identity Verification

Complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud
Be on camera during interviews and assessments
Booz Allen may take your picture to verify your identity and prevent fraud

Candidate AI Usage Policy

Use of AI or other tools to assist with responses during interviews (in-person or virtual) is prohibited unless permission is explicitly provided

Work Model

Onsite: work will primarily be performed full-time at a customer facility, with collaboration required by the role

Location: McLean, VA (onsite)

Compensation: USD 86,800 - 198,000 per year

Experience: 2+ years

Education: Bachelor’s degree

View full job page →

9d ago

Penetration Tester

Deloitte San Antonio, TX

San Antonio, TX

9d ago

Full time Ai Security Api Penetration Testing Application Security

Apply Now

Job Description

Deloitte Global cyber services is seeking a Penetration Tester to execute penetration testing engagements across multiple technology domains and deliver consultative guidance on findings. You will work with AI and LLM-based tools, apply prompt engineering to accelerate reconnaissance and testing automation, and help strengthen team methodologies and playbooks through continuous validation of tool accuracy.

Location: San Antonio, TX (onsite)

What you’ll do

Execute penetration testing engagements, including Web Application Penetration Testing
Execute penetration testing engagements, including Web Services / API Penetration Testing
Execute AI/LLM Penetration Testing efforts using AI-assisted approaches
Run Network Penetration Testing engagements
Perform Mobile Application Penetration Testing
Conduct Thick Client Penetration Testing

Across engagements, you will provide consultative guidance to customers by presenting findings in a clear and actionable manner, both in writing and verbally. You will also enhance and update testing methodologies, processes, and standards documentation.

AI-assisted testing and automation

Use AI and LLM-based tools and prompt engineering to accelerate reconnaissance and generate or refine testing scripts
Build, customize, and maintain AI-driven agents to automate recurring testing tasks
Continuously validate the accuracy and reliability of self-developed AI tools, actively working to reduce hallucinations and false positives in vulnerability identification
Evaluate and integrate emerging AI-assisted offensive security tooling into team methodology and playbooks

You will also analyze and understand complex architecture designs, and effectively communicate the services and capabilities the group can facilitate for clients.

Requirements

Experience with Kali Linux or another dedicated Penetration Testing OS platform
Knowledge of common testing tools such as Burp Professional, AMASS, Metasploit, Postman, Swagger, NMAP, Qualys, SQL Map, and others
Familiarity with OWASP Top 10 software security weaknesses and vulnerabilities
Familiarity with AI models and frameworks from providers such as Anthropic and OpenAI; configuring tools like Obsidian and Ollama is a plus for supporting other workflows
Working knowledge of one scripting language
Familiarity with at least one software programming language and framework
Demonstrated experience working with diverse stakeholders, preferably on a global multi-national basis
Ability to manage concurrent initiatives with effective judgment for prioritization and time management
Strong written and verbal communication skills
Must be a US Citizen

Technologies

Kali Linux
Burp Professional
AMASS
Metasploit
Postman
Swagger
NMAP
Qualys
SQL Map
OWASP Top 10
Anthropic
OpenAI
Obsidian
Ollama

Preferred

Certified Ethical Hacker (CEH)
Offensive Certified Security Professional (OSCP)
Any GIAC certification (GSEC, GWAB, GPEN, GMOB, GCPN)
OWASP Application Security Top 10
OWASP API Security Top 10
OWASP Thick Client Top 10
OWASP LLM Top 10
MITRE ATT&CK Framework
Cloud Service testing
Reverse Engineering
Static Application Software Testing (SAST)
Dynamic Application Testing (DAST)
Experience of Agentic development and its application to support penetration testing

View full job page →

11d ago

Penetration Tester

Deloitte Nashville, TN

Nashville, TN

11d ago

Full time Ai Security Api Penetration Testing Application Security

Apply Now

Job Description

Deloitte’s Global cyber services team is seeking a Penetration Tester to deliver practical security testing across a wide range of modern application and infrastructure surfaces. In this onsite role in Nashville, TN, you will execute penetration testing engagements and support customers with clear, actionable guidance on findings, while helping evolve testing methods through AI/LLM-enabled workflows.

Penetration testing engagements

Execute penetration testing engagements across web applications
Perform web services / API penetration testing
Conduct AI/LLM penetration testing
Carry out network penetration testing
Test mobile applications
Evaluate thick client applications through penetration testing

Consulting and methodology

Provide consultative guidance to customers on identified findings, delivered in writing and verbally in a clear and actionable format
Enhance and update testing methodologies, processes, and standards documentation
Analyze and understand complex architecture designs
Communicate the services and capabilities the group can facilitate for clients
Proactively evaluate and integrate emerging AI-assisted offensive security tooling into team methodology and playbooks

AI/LLM-assisted offensive security

Leverage AI and LLM-based tools and prompt engineering to accelerate reconnaissance and generate or refine testing scripts, using established platforms and emerging frameworks
Build, customize, and maintain AI-driven agents to automate recurring testing tasks
Continuously validate the accuracy and reliability of self-developed AI tools, working to reduce hallucinations and false positives in vulnerability identification

Required skills and experience

Experienced with Kali Linux or other dedicated penetration testing OS platforms
Knowledge of common testing tools, including Burp Professional, AMASS, Metasploit, Postman, Swagger, NMAP, Qualys, SQL Map, and others
Familiarity with OWASP Top 10 software security weaknesses and vulnerabilities
Familiarity with AI models and frameworks from providers such as Anthropic and OpenAI, and experience configuring tools like Obsidian and Ollama is a plus
Working knowledge of one scripting language and familiarity with at least one software programming language and framework
Demonstrated experience working with diverse stakeholders, preferably on a global multi-national basis
Ability to manage concurrent initiatives and use judgment in prioritization and time management
Strong written and verbal communication skills
Must be a US Citizen

Preferred qualifications

Certified Ethical Hacker (CEH)
Offensive Certified Security Professional (OSCP)
Any GIAC certification (GSEC, GWAB, GPEN, GMOB, GCPN)
OWASP Application Security Top 10, OWASP API Security Top 10, OWASP Thick Client Top 10, and OWASP LLM Top 10
MITRE ATT&CK Framework
Cloud service testing
Reverse Engineering
Static Application Software Testing (SAST) and Dynamic Application Testing (DAST)
Experience with agentic development and applying it to support penetration testing

Technologies

Kali Linux
Burp Professional
AMASS
Metasploit
Postman
Swagger
NMAP
Qualys
SQL Map
OWASP Top 10
Anthropic
OpenAI
Obsidian
Ollama

View full job page →

11d ago

Penetration Tester

Tharros Norfolk, VA

Norfolk, VA

11d ago

Full time Active Directory Cobalt Strike Cybersecurity Tools

Apply Now

Job Description

Tharros is seeking a Penetration Tester to support the US Navy’s operational test and evaluation mission. This onsite role in Norfolk, VA focuses on building and executing cyber test plans across operational systems, lab environments, and cyber ranges, with reporting that feeds into the OPTEVFOR cyber OT&E mission. If you have hands-on offensive testing experience and enjoy structured, policy-driven test execution, this position offers a direct path to apply real-world penetration testing in support of operational evaluation.

Responsibilities

Review and build proficiency in OPTEVFOR cyber T&E concept of operations, SOPs, policies, and guidance.
Maintain and participate in the development of 01D SOPs and documentation for DCAT authorization established in DoDI 8585.01.
Research, review, prioritize, and submit operational requirements for acquisition of equipment or cyber capabilities using the 01D tool approval process.
Support development and execution of TTPs for penetration testing and Red Teaming.
Research adversary cyber actors’ TTPs, organizational structures, capabilities, personas, and environments, and integrate findings into cyber survivability test planning and execution.
Participate in OPTEVFOR cyber test planning, including:
- Open-source research and system-under-test documentation review to identify attack surface and threat vectors.
- Check point meetings, test plan objective development, and feasibility review of test plan objectives.
- Test planning site visits and site pre-test coordination visits, including in-brief support.
Support test preparation activities, including red team test plan review and adding system technical information to the test reference library.
Organize and support research presentations for advanced capability development in support of future tests.
Prepare OPTEV-RT test assets (Government Furnished).
Execute test events as assigned, including Cooperative Vulnerability Penetration Assessments, adversarial assessments, and cyber tabletops.
Use OPTEVFOR-provided and NAO approved commercial and open-source network cyber assessment tools (e.g., Core Impact, Nmap, Burp, Metasploit, and Nessus).
Apply ethical hacking knowledge to exploit discovered vulnerabilities and misconfigurations across operating systems (Windows, Linux), protocols (HTTP, FTP), and network security services (PKI, HTTPS) aligned to test objectives.
Conduct testing independently while ensuring safe execution, adherence to the test plan, and compliance with OPTEVFOR policies.
Follow JFHQ-DODIN deconfliction procedures.
Verify collected data for accuracy and completeness.
Participate in post-test iterative documentation (including deficiency and risk sheets) and document lessons learned.
Support OPTEVFOR-required engagements, including capture the flag events, cyber off sites, external engagements (e.g., red team huddles and technical exchange meetings), and creation of required products and materials.
Generate and update documentation to maintain DCAT authorization compliance per DoDI 8585.0.
Process exfiltrated data for analysis and/or dissemination to customers.
Test and evaluate locally developed tools for operational use and implementation.
Perform duties under the supervision of the 01D Cyber Operations Officer.

Requirements

Minimum 3 years experience performing any combination of penetration testing, red teaming, or exploitation development.
Minimum 3 years proficiency in leading red team operators in penetration testing/red teaming to accomplish assigned test objectives.
OSCP (or equivalent certification).
Proficient with offensive tools including Metasploit, Cobalt Strike, Core Impact, Burp Suite, Nessus, and SharpHound/BloodHound.
Ability to validate functionality and safety of offensive tools (e.g., exploits) given source code and to document results.
Ability to detect malicious activity using dynamic analysis techniques and document results.
Ability to independently operate to conduct penetration testing/red teaming to accomplish assigned test objectives.
Skills in assessing current tools for needed improvements and in knowledge management (including technical documentation such as Wiki pages).
Knowledge of current software and methodologies for active defense and system hardening.
Knowledge of encryption algorithms and cyber capabilities/tools (e.g., TLS, PGP).
Knowledge of evasion strategies and techniques; forensic implications of operating system structure and operations; host-based security products and how they affect exploitation and vulnerability.
Knowledge of network administration, network construction and topology, and security hardware/software options and their effects on exploitation.
Knowledge of security implications of software configurations and fundamentals of digital forensics to extract actionable intelligence.
Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations.
Knowledge of Unix/Linux and Windows operating systems structures and internals.
Knowledge of network collection procedures including decryption capabilities/tools, techniques, and procedures.
Ability to test and evaluate tools for implementation and proficiency with Microsoft Office Suite including Teams or similar workplace chat and videoconferencing tools.
Excellent written and verbal communication skills.