SAIC is seeking a Mid-Level Penetration Tester to support an offensive security practice serving state and local government customers. This TX-based remote role focuses on running penetration testing engagements across modern targets, producing clear technical reporting, and helping customers understand risk priorities and remediation options.
Working in a hands-on environment, you will independently lead or support assessments spanning web applications, networks, APIs, mobile apps, wireless environments, and cloud-hosted systems. You will also contribute to internal research, methodology improvements, tool development, and knowledge-sharing, aligned with the NICE Cybersecurity Workforce Framework to strengthen cybersecurity capability growth.
Responsibilities
- Independently perform penetration testing engagements against web applications, networks, APIs, mobile applications, wireless environments, and cloud-hosted systems using both black-box and white-box methodologies.
- Align testing activities with NIST, OWASP, PTES, and industry-recognized security assessment frameworks.
- Develop attack paths, validate vulnerabilities, and demonstrate exploitability while meeting engagement objectives and timelines.
- Manage assigned engagements end-to-end, from planning and scoping through execution, reporting, and customer debriefs.
- Coordinate with senior team members, project managers, and clients to ensure successful delivery.
- Provide technical guidance and mentorship to junior team members when appropriate.
- Produce comprehensive technical reports communicating vulnerabilities, business impact, attack scenarios, and remediation recommendations.
- Present findings to technical teams, management, and executive stakeholders; support customers in understanding risk priorities and remediation strategies.
- Conduct web application security assessments using the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10 methodologies.
- Perform API security assessments for REST, GraphQL, SOAP, and modern authentication mechanisms.
- Conduct mobile application security testing on iOS and Android platforms.
- Participate in source code reviews and secure code assessments as part of white-box engagements.
- Use commercial, government, open-source, and custom-developed tools to identify, exploit, and validate vulnerabilities.
- Develop and maintain scripts, utilities, and testing methodologies to improve assessment efficiency and effectiveness.
- Evaluate emerging attack techniques, vulnerabilities, and security technologies, incorporating findings into team practices.
- Serve as a trusted advisor to customers by communicating technical findings in both technical and business-focused terms.
- Remain current on evolving threats, offensive security techniques, emerging vulnerabilities, and industry best practices.
- Contribute to internal research projects, methodology enhancements, tool development initiatives, and knowledge-sharing activities.
- Support cybersecurity capability growth aligned to the NICE Cybersecurity Workforce Framework.
Requirements
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field (equivalency through relevant experience will be considered).
- Ability to successfully pass a CJIS Criminal Justice background investigation and maintain CJIS eligibility throughout employment.
- 5+ years of hands-on cybersecurity experience, including 2+ years conducting penetration testing or offensive security assessments.
- Strong knowledge of web application security testing methodologies, including OWASP WSTG and OWASP Top 10.
- Experience conducting authenticated and unauthenticated network penetration tests.
- Proficiency with industry-standard testing tools, including Burp Suite Professional, Nmap, Nessus/Tenable, Metasploit, and similar platforms.
- Experience identifying, exploiting, validating, and documenting security vulnerabilities.
- Working knowledge of network protocols, operating systems, Active Directory, authentication mechanisms, and common enterprise architectures.
- Experience creating professional technical reports and presenting findings to technical and non-technical audiences.
- Knowledge of attack frameworks and methodologies, including MITRE ATT&CK, NIST, and PTES.
- Strong analytical, troubleshooting, and problem-solving skills.
- Industry-recognized penetration testing certifications preferred, such as OSCP, GWAPT, PNPT, GPEN, OSEP, OSWE, PenTest+, eJPT/eCPPT.
Location, Schedule, and Pay
- Location: Remote work in TX, US
- Schedule: Full-Time
- Shift: Day Job
- Travel: Yes, 10% of the time
- Minimum clearance: None
- Clearance level required to obtain: None
- Target salary range: $60,001 - $100,000 (USD) per year
Preferred Experience
- Experience conducting mobile application security assessments using tools such as Frida, Objection, MobSF, and ADB.
- Experience assessing APIs, cloud environments (Azure, AWS, GCP), and containerized applications.
- Source code review experience in languages such as Java, C#, Python, JavaScript, or Go.
- Familiarity with red team operations, adversary emulation, and attack path analysis.
- Experience with scripting or automation using Python, PowerShell, Bash, or similar languages.
- Knowledge of cloud security architectures, digital forensics, malware analysis, or reverse engineering.
- Experience mentoring junior penetration testers or leading portions of assessment engagements.
- Participation in security research, bug bounty programs, Capture-the-Flag competitions, or public vulnerability disclosures.
Technologies: NIST, OWASP, PTES, OWASP Web Security Testing Guide (WSTG), OWASP Top 10, REST, GraphQL, SOAP, NICE Cybersecurity Workforce Framework, MITRE ATT&CK, Burp Suite Professional, Nmap, Nessus, Tenable, Metasploit, OSCP, GWAPT, PNPT, GPEN, OSEP, OSWE, PenTest+, eJPT, eCPPT, Frida, Objection, MobSF, ADB, iOS, Android, Azure, AWS, GCP, Python, PowerShell, Bash, Java, C#, JavaScript, Go
