Security Testing

Security Testing Cybersecurity Jobs

323 jobs found

Today

Cybersecurity Analyst, Advanced

Naval Nuclear Laboratory Schenectady, NY

Schenectady, NY

Today

$86k - $135k/yr Full time Adversary Emulation Incident Response Information Security

Apply Now

Job Description

Naval Nuclear Laboratory (NNL) is seeking a Cybersecurity Analyst, Advanced to advance red team operations and adversary-based security testing across enterprise environments. This onsite role in Schenectady, NY, US supports efforts to strengthen detection and defensive capabilities through penetration testing, adversary emulation, and purple team engagement.

In this position, you will coordinate closely with the SOC, incident response, and engineering teams to execute realistic attack chains and translate findings into actionable remediation guidance for both technical and executive stakeholders.

Core Responsibilities

Lead and participate in red team assessments and penetration tests.
Perform internal and external penetration testing across networks, systems, applications, cloud environments, APIs, and wireless infrastructure.
Conduct advanced red team operations using adversary emulation aligned with MITRE ATT&CK techniques.
Simulate real-world threats, including nation state actors and advanced persistent threat (APT) tradecraft.
Identify gaps in detection, response, and defensive posture using realistic attack chains and multistage operations.
Collaborate with blue teams during purple team exercises to improve detection logic, response capabilities, and overall SOC effectiveness.
Support cybersecurity system maintenance, upgrades, incident response activities, and threat hunting.
Coordinate stakeholders during tabletop incident response exercises and cybersecurity decision-making scenarios.
Produce detailed technical reports and executive level summaries, including clear remediation guidance.
Present results to internal stakeholders and customers in a clear and actionable format.
Serve as a technical lead for zero day vulnerability response, including rapid analysis and development of mitigation strategies.
Assist in developing and refining cybersecurity policies, standards, procedures, and playbooks based on offensive testing outcomes.
Support government-directed cybersecurity data calls to ensure timely and accurate reporting.

Requirements

Bachelor’s degree from an accredited college or university and minimum 4 years of relevant experience; or
Master’s degree from an accredited college or university in a related field and minimum 2 years of relevant experience.

Technologies

MITRE ATT&CK

Preferred Skills

Strong understanding of cybersecurity principles and offensive security methodologies.
Excellent teamwork, communication, and organizational capabilities.
Robust troubleshooting and problem solving skills.
Ability to collaborate across multiple locations.
Penetration testing or red team experience.
Knowledge of networking protocols.
Experience with Active Directory.
Proficiency in Linux and Windows environments.
Scripting experience.
Familiarity with red team tools and frameworks.
Ability to deliver clear presentations and produce well-structured technical documentation.

Compensation

$86,100.00 - $134,600.00 annually.
Salary information is provided as a general guideline; annual salary is based on candidate experience and qualifications, as well as market and business considerations.

Benefits

Health, Dental, Vision & Voluntary Benefits
Disability, Life & Accident Insurance
401(k) Savings program & Capital Accumulation Plan
Personal & Medical Time Off
Paid Parental Leave
Flexible Work Schedules
Tuition Assistance for Eligible Employees
Student Debt Benefit Personal Time Off Sell Program
Employee Assistance Program (EAP)
Wellness Program
Visit us online to view all NNL benefits!

Citizenship and Eligibility / Compliance

All candidates must be U.S. citizens.
Applicants selected will be subject to a Federal background investigation and must meet eligibility requirements for access to classified matter.
FMP is a government contractor and maintains a drug free workplace and workforce.
All candidates must be able to pass a drug test in compliance with FMP company policy and 10 CFR 707.

View full job page →

Today

Information Security Analyst

One Community Bank McFarland, WI

McFarland, WI

Today

Full time Information Security InfoSec Security

Apply Now

Job Description

One Community Bank is seeking an Information Security Analyst to help validate that technology controls operate as intended and to support ongoing improvements to the organization’s security posture. This entry-level role focuses on testing, documentation, and coordination across teams, with work that supports audits/exams, incident response, and security awareness activities.

The role is based in McFarland, WI and is performed onsite. The position is open to candidates with 1+ years of experience in information security or IT, and it requires a Bachelor’s degree in Information Systems (or related field).

What you’ll do

Perform internal control testing and document results
Review penetration testing outcomes and track remediation efforts
Test and assess new technologies against established security requirements
Advise on IT security requirements and contribute to control design
Support audits/exams, including both internal and external processes
Contribute to incident response, business continuity, and security awareness efforts

What you bring

Bachelor’s degree in Information Systems (or related field)
1+ year in information security or IT
Proficiency with Microsoft applications
Strong written and verbal communication
Familiarity with patch management, firewalls, antivirus, IDPS, and security documentation

Tools and technologies

Microsoft applications
Patch management
Firewalls
Antivirus
IDPS
Security documentation

Schedule and day-to-day flow

Monday–Friday, 8am–5pm, onsite
Check in on open security items and coordinate with teammates and internal partners on what needs attention
Review findings, organize evidence for auditors, and maintain clear notes in shared documentation
Gather feedback from end users, translate it into actionable improvements, and help make security guidance easy to understand
Validate changes as new tools or updates roll out to ensure controls remain effective and well-supported

Benefits

Medical, Dental, and Vision coverage
401(k)
Life Insurance
Flexible Spending Account (FSA)
Paid Time Off
Bank-paid Short-term and Long-term disability insurance

About One Community Bank

They serve clients, support colleagues, and invest in communities, with aspirations to be the Best Billion Dollar Bank in the World
Grew from a single location in Oregon, Wisconsin in 1976 to 19 locations
Voted a Top Work Place eight years in a row

View full job page →

Today

Senior Penetration Tester (WebApp and Network)

Rapid Strategy Charlotte, NC 🇺🇸 Remote

Charlotte, NC

Today

$50 - $65/hr Part time Senior Application Security Cybersecurity Tools

Apply Now

Job Description

Support security validation for web applications and network environments through hands-on penetration testing and vulnerability discovery.

Responsibilities

Perform thorough penetration tests targeting web applications to uncover security vulnerabilities.
Use penetration testing tools and established methodologies to simulate real-world cyber attacks.
Identify weaknesses and vulnerabilities in web applications using a mix of manual and automated testing approaches.
Test and exploit common web application vulnerabilities, including SQL injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and others.
Produce detailed penetration test reports documenting findings and recommendations for security improvements.
Partner with development teams to advise on security best practices.
Stay current on evolving cybersecurity threats and new testing methodologies.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field.
5+ years of experience in penetration testing or security assessment.
Relevant industry certifications, such as CEH, OSCP, or GIAC Web Application Penetration Tester (GWAPT).
Strong working knowledge of web application technologies and protocols (including HTTP/HTTPS, HTML, JavaScript, etc.).
Hands-on proficiency with tools such as Burp Suite, OWASP ZAP, Metasploit, and SQLMap.
Experience working with known exploits and understanding their mitigation.
Ability to analyze penetration test outcomes and communicate results effectively through reporting.
Strong problem-solving and analytical skills.
Excellent communication skills to collaborate with cross-functional teams.

Technologies & Skills

HTTP/HTTPS, HTML, JavaScript
Burp Suite, OWASP ZAP, Metasploit, SQLMap
SQL injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF)
Python, Ruby

Desirable Skills

Experience with scripting or programming languages such as Python, JavaScript, or Ruby.
Knowledge of network security and operating systems.
Familiarity with cloud environments and container technologies.

Location: Charlotte, NC (remote). Job type: part time (1099 part-time positions available). Travel: possible. Compensation: USD 50 - 65 per hourly.

View full job page →

Today

Penetration Tester

Leidos Herndon, VA

Herndon, VA

Today

$131k - $237k/yr Full time Enterprise Risk Information Security InfoSec

Apply Now

Job Description

Join Leidos to support an enterprise IT program by delivering high-impact penetration testing and ethical hacking. This onsite role in Herndon, VA helps senior decision makers understand risk and make strategic investment choices, with documented findings and actionable results. Salary range: $131,300 - $237,350 per year.

What you’ll do

Provide highly technical, in-depth penetration testing in support of enterprise cyber security objectives.
Specialize in penetration testing and ethical hacking to target, assess, and exploit risks and vulnerabilities in information systems.
Deliver documented and actionable data to senior decision makers to support strategic investment decisions.
Document identified system risks, planned test procedures, and results; analyze vulnerabilities found during testing; and review program-level documentation such as requirements specifications, system architecture and design documents, test plans, and security plans.
Recommend changes to program-level documentation to help reduce system vulnerabilities; create and document penetration testing plans and procedures, including approved plans used to conduct hands-on testing.
Analyze test results, document risks, recommend countermeasures, and support or lead technical exchange meetings and application review boards. Capture and document action items, results, and brief management on status and outcomes.

Skills and experience needed

Active TS/SCI with Poly to be considered
10+ years of relevant experience in cyber security or a related IT field
Experience with cyber penetration testing and applying computer attack methods and system exploitation techniques
Working knowledge of cyber security principles for Linux, Windows, and virtual platforms
Experience designing, testing, or implementing IT security architecture
Experience performing network security analysis and analyzing network architectures
Experience using network management tools
Experience leveraging adversarial tactics for hands-on security testing
Experience developing risk management methodologies and analyzing test results to develop risk and threat mitigation plans
Experience testing or reviewing system configuration, development, and design for enterprise systems and hypervisors
Experience designing, testing, or implementing complex Windows installations

Relevant technologies

Linux
Windows
Virtual platforms
Hypervisors

Benefits

Health and Wellness programs
Income Protection
Paid Leave
Retirement

Preferred qualifications

Experience participating in public and private information security groups and organizations
Experience communicating vulnerability results and risk posture to senior executives
Experience researching, evaluating, and developing security policies and guidance
Experience performing complex technical tasks with minimal direction

Education

Bachelor’s degree or Masters in Computer Science, Information Systems, Engineering, or other related scientific or technical field.

Additional information

Original posting: June 26, 2026

Pay range: $131,300.00 - $237,350.00

Security and privacy notices

Leidos will never ask you to provide payment-related information during the employment application process, nor will it advance money as part of hiring.
Leidos will communicate through emails generated by the Leidos.com automated system, not via free commercial services or messaging apps.
If you receive an email requesting payment-related or other personal information, contact LeidosCareersFraud@leidos.com.
If you believe you are a victim of a scam, contact local law enforcement and report to the U.S. Federal Trade Commission.

Non-discrimination commitment

Leidos provides equal employment opportunities without regard to protected characteristics and will consider qualified applicants with criminal histories consistent with relevant laws.

View full job page →

Today

AppSec Security Evaluator

AuraOne Human Data Remote 🇺🇸 Remote

Remote

Today

Contract Adversarial Ai Adversarial Prompting Ai Evaluation

Apply Now

Job Description

AuraOne Human Data is building adversarial evaluation into its AI AppSec process so models are hardened before they ship to customers. This remote contract role supports that goal by running red-team style security assessments, focusing on jailbreak and policy-bypass weaknesses through carefully crafted adversarial prompts.

As an AppSec Security Evaluator, you will probe AI behavior in both single-turn and multi-turn settings, produce clear failure reports with reproduction details, and help the safety team prioritize fixes and regress-test coverage as new attack vectors appear.

Responsibilities

Design adversarial prompts to probe known weakness classes for AppSec Security Evaluator assignments, including jailbreak, policy bypass, and prompt injection.
Document every successful attack with reproduction steps and the policy clause that was violated.
Score model defenses across single-turn and multi-turn conversations.
Triage emerging attack vectors and route them to the safety team with severity ratings.
Maintain a personal library of attack patterns and propose new red-team rubrics.
Calibrate with the broader red-team cohort to keep coverage and severity consistent.

Requirements

Demonstrated experience red-teaming AI systems, security research, or adversarial ML work for AppSec Security Evaluator roles.
Strong written communication, since reports function as the patch ticket.
Comfort working in policy-grey areas, with clear documentation of what was attempted and why.
Familiarity with prompt-injection, jailbreak, and policy-bypass taxonomies.
Reliable async availability for at least 10 hours per week.

Skills

Adversarial prompting
Red-team analysis
Policy taxonomy
Failure documentation
AppSec Security evaluation
Security review
Adversarial testing
Threat modeling
AppSec

Work Model

Remote (remote)
Remote · Independent specialist contractor
Employment type: CONTRACTOR
Applicants must be authorized to work from US.

Compensation

Hourly rate confirmed after the interview process.

Application Process

Apply through AuraOne's specialist intake for role-specific routing and review.
Final project scope, schedule, and contractor terms are confirmed before placement.

Example Tasks

Construct a 5-turn adversarial conversation that bypasses a specific policy clause and write up the patch ticket.
Score a model's defenses against a known jailbreak pattern across 20 variants.
Propose a new red-team rubric category after spotting an emerging attack vector.
Reproduce a failure another reviewer reported and confirm the severity tag.

Nice to Have

Background in offensive security, AppSec, or trust & safety operations.
Experience publishing or reproducing public adversarial-ML research.
Multilingual fluency for cross-language attack testing.

Why this role matters

Adversarial evaluation is how AuraOne hardens AI models before they ship to customers.

View full job page →

Today

Penetration Tester

General Dynamics Information Technology Remote 🇺🇸 Remote

Remote

Today

$123k - $167k/yr Full time Api Security Application Security Cloud Platforms

Apply Now

Job Description

Support the Case Management Modernization (CMM) Program with hands-on penetration testing and security assessment activities ahead of Application ATO.

Responsibilities

Perform application, API, and cloud penetration tests on CMM systems prior to ATO submission.
Conduct web, mobile, API, and microservices security testing using industry-standard tools and manual exploitation techniques.
Execute AWS cloud penetration testing within approved boundaries including IAM, S3, Lambda, API Gateway, ECS/EKS, and networking.
Run static and dynamic analysis, including security-focused code review.
Conduct credentialed and uncredentialed scans, privilege escalation testing, and lateral movement analysis.
Validate implementation of NIST 800-53 controls across AC, AU, IA, SC, SI, and CM families.
Support RMF Step 3 (Security Assessment) activities and provide evidence for ATO packages.
Identify vulnerabilities across application layers, cloud infrastructure, and CI/CD pipelines.
Partner with developers, cloud engineers, and DevSecOps teams to validate fixes and retest vulnerabilities.
Provide detailed remediation guidance aligned with secure coding and cloud security best practices.
Track findings in Jira or equivalent tools and ensure closure prior to ATO milestones.
Prepare Security Assessment Reports (SAR), penetration test summaries, and risk findings for AO stakeholders.
Document exploitation steps, proof-of-concepts, and risk severity aligned with federal scoring methodologies.
Contribute to System Security Plans (SSP), POA&Ms, and ATO evidence packages.
Support pre-ATO readiness reviews, including control validation and security walkthroughs.
Participate in tabletop exercises, threat modeling sessions, and architecture reviews.
Validate system resilience through stress, failover, and adversarial resilience testing.
Ensure compliance with federal security standards including NIST, FISMA, and AO-specific guidelines.
Integrate security testing into Agile sprints and provide security input during sprint planning, backlog refinement, and release readiness reviews.
Support secure CI/CD pipeline enhancements, including automated security scanning.

Requirements

8+ years of experience in penetration testing, application security, or ethical hacking security roles.
Experience documenting test plans, test procedures, and detailed security findings.
Experience supporting federal security assessments or enterprise-scale security testing.
Hands-on penetration testing experience for web applications, APIs, microservices, and cloud environments.
Strong proficiency with tools such as Burp Suite, OWASP ZAP, Metasploit, Nmap, Nessus, Nikto, K6 Security, or custom scripts.
Experience testing applications built with NodeJS, ReactJS, REST APIs, and microservices.
Strong AWS security understanding including IAM, VPC, S3, Lambda, API Gateway, ECS/EKS, CloudTrail, and CloudWatch.
Experience with NIST 800-53, RMF, FedRAMP, or federal ATO processes.
Ability to interpret logs, metrics, and security telemetry to identify attack paths.
Familiarity with SIEM and monitoring tools such as Datadog, ELK, CloudWatch, and Grafana.
Experience with container security (Docker, Kubernetes, OpenShift).
Understanding of network security, distributed tracing, and adversarial testing techniques.
Strong analytical, communication, and documentation skills.
8+ years general experience with BS/BA degree, or 6+ years with MA/MS degree (may be considered in lieu of degree).
6+ years experience in integration, regression, and system testing using automated testing tools in web-based applications.
Experience writing test cases, test plans, executing test scripts, reporting defects, and preparing test result reports.
Experience across the QA Life Cycle, including designing, developing, executing, and documenting QA processes (test plans, test cases, test procedures, and test scripts).
OSCP, OSWE, GWAPT, GPEN, or similar offensive security certifications.
AWS Security Specialty.
SAFe, DevSecOps, or Agile certifications are beneficial.
AWS Certified Security - Specialty (AWS Security Specialty | Amazon Web Services).

Technologies

React, NodeJS, microservices, REST APIs
AWS: IAM, VPC, S3, Lambda, API Gateway, ECS/EKS, CloudTrail, CloudWatch
Container and orchestration: Docker, Kubernetes, OpenShift
Testing and security tools: Burp Suite, OWASP ZAP, Metasploit, Nmap, Nessus, Nikto, K6 Security, custom Python/JavaScript tools
Observability/monitoring: Datadog, ELK Stack, Prometheus, Grafana
CI/CD and tooling: Jenkins, GitLab CI/CD, GitHub Actions, SonarQube, Checkmarx, Fortify
Collaboration/work tracking: Jira, Confluence, SharePoint, MS Teams
Analytics: Power BI

Location and Work Details

Location: Remote (working from the USA)
Travel required: None

Salary

Range: $123,250 - $166,750 per year

Additional Information

Category: Cyber and IT Risk Management
Req#: RQ223925
Requisition type: Regular
Public trust: Other
Clearance level: None
Key skills for success: Automated Testing, AWS Cloud Computing, Infrastructure Penetration Testing, Security Controls, Security Testing

Work Requirements (Interview/Verification)

Virtual interviews require being on camera.
Identity verification may include taking your picture to prevent fraud.
Authorization to collect, process, and use biometric data for identity verification and security purposes.

View full job page →

Today

Penetration Tester

Security On-Demand Remote 🇺🇸 Remote

Remote

Today

Full time Application Security Engineer Information Security

Apply Now

Job Description

The Penetration Tester role at Security On-Demand is a hands-on, offensive security position focused on delivering end-to-end client engagements within an established scope. The work includes performing network, web, and cloud assessments and producing client-ready deliverables that support clear decision-making and remediation.

Key Responsibilities

Conduct internal and external network penetration tests, including enumeration, exploitation, lateral movement, and post-exploitation activities within defined scope.
Perform web application assessments aligned to OWASP Top 10 and support API security testing standards.
Carry out basic cloud security assessments for AWS, Azure, and GCP, including misconfiguration identification, IAM review, and exposed services enumeration.
Apply experience from adversarial engagements such as red team and purple team exercises.
Support AI/LLM security assessments covering prompt injection and model abuse scenarios under senior guidance, including OWASP LLM Top 10 coverage.
Prepare complete, client-ready findings reports with clear technical narratives, reproduction steps, risk ratings, and remediation guidance.
Participate in client kick-off calls and debrief walkthroughs, communicating results professionally to both technical and non-technical stakeholders.
Maintain engagement documentation, time tracking, and artifact organization in project management systems.
Continue skill development through assigned training, lab environments, and certification advancement.
Travel up to 25% of the time may be required.

Required Qualifications

2 to 5 years of professional penetration testing or applied offensive security experience; strong candidates with equivalent demonstrated skills will be considered.
Proficiency with standard offensive security toolsets including Nmap, Metasploit, Burp Suite, Nessus/OpenVAS, BloodHound, or equivalents.
Solid understanding of networking fundamentals such as TCP/IP, DNS, HTTP/S, AD, and VPNs, along with common vulnerability classes.
Familiarity with at least one scripting language, including Python, Bash, or PowerShell, for basic automation and tooling.
Exposure to AWS, Azure, or GCP and awareness of common cloud misconfiguration patterns.
Solid understanding of AI technology in everyday work activities.
Strong written communication skills to produce accurate, professional-quality findings documentation.
Hands-on penetration testing certifications such as PNPT (TCM Security), OSCP (Offensive Security), CompTIA PenTest+, or eWPT/eJPT with demonstrated experience.

Technology Areas

Penetration testing tools: Nmap, Metasploit, Burp Suite, Nessus, OpenVAS, BloodHound
Scripting: Python, Bash, PowerShell
Cloud platforms: AWS, Azure, GCP
Core concepts: TCP/IP, DNS, HTTP/S, AD, VPNs
Assessment frameworks: OWASP Top 10, OWASP LLM Top 10
Certifications: PNPT (TCM Security), OSCP (Offensive Security), CompTIA PenTest+, eWPT, eJPT

Department and Employment Details

Department: Offensive Security

Employment type: Full Time

Workplace type: Fully remote

Location: Remote (Remote - United States)

Professional Growth, Location, and Travel

Travel may be required up to 25% of the time.
Candidates must be U.S. citizens and currently reside within the United States.

Information Security Expectations

Understand and follow information security policies and procedures.
Remain vigilant by reporting suspicious activity or possible weaknesses in information security.
Actively participate in efforts to maintain and improve information security.
This role is considered Moderate Risk with potential to view, access, or download restricted/private client/internal data, which must be handled with sensitivity in the most secure manner.
HR reserves the right to perform random background/drug screens to support client and Security On-Demand data safety.