Security Testing Tools

Security Testing Tools Cybersecurity Jobs

13 jobs found

Today

Security Engineer III, Red Team Operator (TS Clearance)

Deloitte Rosslyn, VA

Rosslyn, VA

Today

$111k - $218k/yr Full time Senior Cloud Platforms Cobalt Strike

Apply Now

Job Description

Operate as an adversary simulation specialist to test and strengthen enterprise detection, response, and resilience.

Responsibilities

Plan and carry out red team engagements across enterprise environments, web applications, cloud platforms, and endpoints
Emulate advanced threat actors using realistic attack paths, tools, and techniques
Simulate reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration
Evaluate the effectiveness of security controls, monitoring, and incident response processes
Conduct authorized phishing, social engineering, and credential attack exercises
Create custom payloads, scripts, and attack workflows to support engagement objectives
Document findings, attack chains, defense gaps, and remediation recommendations
Produce after-action reports and technical debriefs for stakeholders, including leadership
Partner with blue teams, detection engineers, and security leadership to improve defensive capabilities
Follow rules of engagement, legal requirements, and operational safety standards

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field
Active Top-Secret clearance
Ability to work onsite in Rosslyn, VA up to 5 days a week
Knowledge of network architecture, protocols, and techniques (e.g., tunneling)
Hands-on offensive security experience in red teaming, purple teaming, or adversary simulation
Strong command of enterprise attack techniques across Windows, Active Directory, Linux, cloud, and identity environments
Experience with command and control frameworks, privilege escalation, lateral movement, and evasion techniques
Proficiency with Cobalt Strike, Mythic, Metasploit, BloodHound, Burp Suite, Nmap, plus PowerShell or Python
Experience mapping activities to MITRE ATT&CK and performing threat emulation
Ability to write high-quality reports linking technical findings to business risk
CRTO (Certified Red Team Operator) or OSCP (Offensive Security Certified Professional)
Ability to travel 20% on average based on client needs and served industries/sectors
Legally authorized to work in the United States without employer sponsorship now or in the future

Technologies

Cobalt Strike
Mythic
Metasploit
BloodHound
Burp Suite
Nmap
PowerShell
Python
MITRE ATT&CK

Team and Work

Red Team Operator role on the Cyber Defense & Resilience team focused on adversary emulation and improving defensive readiness
Deloitte Cyber Defense & Resilience supports clients by transforming security operations, monitoring technology, data analytics, and threat intelligence
Helps manage and protect dynamic attack surfaces and provides rapid crisis and cyber incident response to support readiness, response, and recovery from business disruptions

Preferred

Experience with C2 frameworks such as Cobalt Strike, Havoc, Mythic, Sliver
Cloud red teaming experience in AWS, Azure, or GCP
Familiarity with detection engineering, SIEM, EDR, and purple team exercises
Experience developing custom tooling or modifying public offensive tools
Knowledge of malware analysis, reverse engineering, or exploit development

Compensation

Estimated wage range: $110,700 - $218,300 USD per year
May be eligible for a discretionary annual incentive program based on applicable rules, individual performance, and organizational performance

View full job page →

Today

Security Engineer III, Red Team Operator (TS Clearance)

Deloitte Baltimore, MD

Baltimore, MD

Today

$119k - $218k/yr Full time Cloud Platforms Cybersecurity Tools Data Security

Apply Now

Job Description

Join Deloitte’s Cyber Defense & Resilience team as a Security Engineer III, Red Team Operator, delivering adversary emulation to strengthen detection, response, and resilience across enterprise environments.

Responsibilities

Plan and execute red team operations across enterprise environments, web applications, cloud platforms, and endpoints
Emulate advanced threat actors using realistic attack paths, tools, and techniques
Run simulations for reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration
Evaluate the effectiveness of security controls, monitoring, and incident response processes
Conduct authorized phishing, social engineering, and credential attack exercises
Develop custom payloads, scripts, and attack workflows to support engagements
Document findings, attack chains, defensive gaps, and remediation recommendations
Deliver after-action reports and debriefs to technical and leadership stakeholders
Collaborate with blue teams, detection engineers, and security leadership to improve defensive capabilities
Maintain strict adherence to rules of engagement, legal requirements, and operational safety

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field
Active Top-Secret Clearance
Onsite availability up to 5 days per week in Baltimore, MD
2+ years of experience with:
- Network architecture, protocols, and techniques (example: tunneling)
- Hands-on offensive security in red teaming, purple teaming, or adversary simulation
- Enterprise attack techniques across Windows, Active Directory, Linux, cloud, and identity environments
- Command and control frameworks, privilege escalation, lateral movement, and evasion techniques
- Tooling proficiency including Cobalt Strike, Mythic, Metasploit, BloodHound, Burp Suite, Nmap, and PowerShell or Python
- MITRE ATT&CK mapping and threat emulation
- Ability to write high-quality reports connecting technical results to business risk
CRTO (Certified Red Team Operator) or OSCP (Offensive Security Certified Professional)
Ability to travel 20%, on average, based on work and client/industry needs
Legally authorized to work in the United States without employer sponsorship, now or in the future

Technologies

Cobalt Strike
Mythic
Metasploit
BloodHound
Burp Suite
Nmap
PowerShell
Python
MITRE ATT&CK
Havoc
Sliver
AWS
Azure
GCP

Team

Deloitte Cyber helps address the unique challenges and opportunities businesses face in cybersecurity
Cyber Defense & Resilience supports clients in defending against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence
Supports management and protection of dynamic attack surfaces and rapid crisis and cyber incident response to enable readiness, response, and recovery from business disruptions

Skills for Success

Ability to work independently and collaborate with a team
Effective written and verbal communication skills
Meticulous attention to detail and quality of work product
Ability to build and sustain professional relationships
Ability to lead projects or workstreams
Ability to manage and prioritize multiple tasks in a fast-paced environment
Strong interpersonal skills and professional demeanor
Ability to meet deadlines
Ability to provide clear guidance to others

Preferred

Experience with C2 frameworks such as Cobalt Strike, Havoc, Mythic, Sliver
Experience with cloud red teaming in AWS, Azure, or GCP
Familiarity with detection engineering, SIEM, EDR, and purple team exercises
Experience developing custom tooling or modifying public offensive tools
Knowledge of malware analysis, reverse engineering, or exploit development

Salary range: USD 119,000 - 218,300 per year

View full job page →

5d ago

Wireless Penetration Tester

Xtreme Solutions Corporate San Bernardino, CA

San Bernardino, CA

5d ago

Full time Aircrack Ng Cybersecurity Tools Data Security

Apply Now

Job Description

Join a wireless security assessment effort focused on testing County secure and guest Wi-Fi networks for weaknesses and segmentation gaps.

Responsibilities

Attempt to gain access to password-protected County wireless networks to validate control effectiveness.
Assess segmentation controls between guest (internet-only) and internal wireless networks.
Evaluate wireless attack vectors with the goal of identifying paths that could lead to confidential data exposure.
Maintain stealth during testing to avoid detection while performing assessments.
Document the wireless attack surface, identified exploited weaknesses, and remediation guidance.

Requirements

3+ years of wireless security assessment experience.
Proficiency with wireless attack tooling such as Aircrack-ng, Kismet, or equivalent tools.
Hands-on experience with RF hardware used for wireless assessment activities.

Preferred Qualifications

OSWP or GAWN certification.
Experience testing multi-site enterprise Wi-Fi deployments.

Technologies

Aircrack-ng
Kismet

Location and Travel

San Bernardino, CA (onsite)
Onsite travel required to department locations including San Bernardino, Colton, Redlands, Rialto, Fontana, Ontario, Rancho Cucamonga, Montclair, Victorville, Hesperia, Big Bear Lake, and Yucca Valley.
Travel, lodging, and per diem are firm-borne.

View full job page →

7d ago

Senior Web Application Penetration Tester

U.S. Bank National Association Charlotte, NC

Charlotte, NC

7d ago

$112k - $131k/yr Full time Senior Application Security Information Security

Apply Now

Job Description

Advance web application security with a role focused on finding vulnerabilities, validating risk, and driving practical mitigation. This Senior Web Application Penetration Tester position supports the information security program through rigorous testing and collaboration with cross-functional partners. You can work in a hybrid environment, with in-office expectations of 3+ days per week and flexibility for additional time at select locations in the U.S.

What you’ll do

Assess the security of web applications by identifying vulnerabilities and recommending mitigation strategies to enhance resilience against cyber threats.
Contribute toward the success of the organization’s information security program.
Collaborate with cross-functional teams to support effective security outcomes.

Requirements

Bachelor’s degree in Engineering or Science, or equivalent work experience.
8+ years of experience in information security.
2+ years experience in areas such as IT infrastructure management, application architecture, risk management, data architecture, middleware technology, and IT operations and project management.
5+ years performing web application and/or API penetration testing.
3-5 years or more of technical writing and documentation experience.
Familiarity with and understanding of information security architecture.
3+ years experience with and understanding of IT standards, procedures, and policies.
Subject matter expertise (5+ years) in information security technologies, including Burp Suite Pro and OWASP Zap.
Strong knowledge of web application security principles, OWASP Top 10, and industry best practices for secure web application development.
Hands-on manual testing experience, including SQL injection, cross-site scripting (XSS), CSRF, and other common web application vulnerabilities.
Excellent written and verbal communication skills, with the ability to explain technical concepts to both technical and non-technical stakeholders.

Tools and focus areas

Burp Suite Pro
OWASP Zap
OWASP Top 10
SQL injection, cross-site scripting (XSS), CSRF

Helpful qualifications (preferred)

Offensive Security Web Assessor Certification (OSWA), GIAC Web Application Penetration Tester (GWAPT), or similar (plus).
Offensive Security Certified Professional (OSCP) (plus).
Experience with ServiceNow Application Vulnerability Response (plus).
Understanding and experience with change control (plus).
Product and vendor evaluation experience (plus).

Hybrid schedule and location

Charlotte, NC (hybrid). In-office expectation is 3 or more days per week. Flexibility for other days is available at one of the following locations: Cincinnati, OH or Minneapolis, MN or Charlotte, NC.

Compensation

USD 111,605 - 131,300 per year.

Benefits

Healthcare (medical, dental, vision)
Basic term and optional term life insurance
Short-term and long-term disability
Pregnancy disability and parental leave
401(k) and employer-funded retirement plan
Paid vacation (from two to five weeks depending on salary grade and tenure)
Up to 11 paid holiday opportunities
Adoption assistance
Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law

Equal opportunity, background checks, and eligibility

U.S. Bank is an Equal Opportunity Employer, considering all qualified applicants without regard to protected characteristics under applicable law.
E-Verify: U.S. Bank participates in the U.S. Department of Homeland Security E-Verify program in all facilities located in the United States and certain U.S. territories.
Background checks / Fair Chance: U.S. Bank will consider qualified applicants with arrest or conviction records and conducts background checks consistent with applicable local laws and federal requirements.
Certain roles may be subject to additional regulatory requirements depending on the position.

Disability accommodations

If you need accommodations during any portion of the application or hiring process, please refer to U.S. Bank’s disability accommodations for applicants.

View full job page →

8d ago

Senior Penetration Tester

Schellman Remote 🌍 Remote

Remote

8d ago

Full time Senior Cybersecurity Tools Data Security

Apply Now

Job Description

Schellman is hiring a Senior Penetration Tester to support hands-on penetration testing engagements across on-premise and cloud-based networks and applications. In this remote role, you will execute testing procedures, perform analysis, and deliver well-documented results while strengthening your technical skills through mentorship, collaboration, and client-focused delivery.

Role summary

This position emphasizes structured skill development and high-quality client outcomes. You will contribute to practice development and thought leadership while establishing strong working relationships with client personnel throughout the engagement lifecycle.

Key responsibilities

Comply with Schellman’s code of ethics and professional conduct, methodologies, and applicable policies and procedures
Meet professional and regulatory standards relevant to assigned service line specialization(s)
Support Schellman’s company culture and model Schellman values
Build high-quality client relationships and rapport with client personnel
Manage client expectations to help ensure outcomes exceed expectations
Complete assigned duties on time with strong attention to detail
Collaborate with project team members across the full project lifecycle and keep work aligned with schedules
Escalate internal issues in a proper and timely manner
Use discretion and decorum in the timing, form, and content of client communications
Book travel reservations in a timely manner in accordance with Schellman travel and expense policies
When qualified and called upon, perform the essential functions of other service delivery positions
Attend project kick-off and closing meetings
Execute assigned testing procedures, analyze findings, reach conclusions, document results per company standards, and suggest improvements when applicable
Draft project deliverables
Serve as a contact for clients’ basic engagement questions
Participate in recruiting and candidate interview activities
Train project team members and acclimate newer team members
Contribute to Schellman practice development and develop expert knowledge of professional and regulatory standards relevant to the specialization(s)
Contribute to Schellman thought leadership (for example, articles, webinars, or public speaking)

Required qualifications

Bachelor’s degree in technology, computer science, or another relevant subject area, or equivalent years of experience related to the duties and responsibilities
3+ years of hands-on penetration testing experience
1+ year experience in web application penetration testing
Strong ability to work independently, with teams, and with clients
Offensive Security Certified Professional (OSCP) (Required)
Requisite knowledge of applicable technology and security domains
High attention to detail and quality of work product
Client service orientation
Excellent time management, organizational, and verbal and written communication skills
Ability to work on-site or remotely as a valuable contributor to a collaborative team
Capacity to manage tasks across multiple projects simultaneously
Proficiency using Microsoft Word, Excel, and PowerPoint, and Schellman service delivery applications
Full understanding and application of ethics, independence, and Schellman values
Proficiency with at least two scripting languages (for example, Python, Bash, JavaScript, PowerShell)
Demonstrated enthusiasm for information security (for example: GitHub repo, blogs, presentations, conference talks, local security association membership, or participation in free skill-building or hacking challenges such as SANS Holiday Hack, HackerOne CTF, or HackTheBox)
Competency in common operating systems (for example, Windows, macOS, Linux)
Understanding of cloud computing models, technologies, and concepts

Technologies and tools

OSCP, CRTO
Burp Suite
Python, Bash, JavaScript, PowerShell
Microsoft Word, Microsoft Excel, Microsoft PowerPoint
Windows, macOS, Linux
GitHub
SANS Holiday Hack, HackerOne CTF, HackTheBox

Remote work and travel

Opportunity to work remotely unless otherwise stated in the job requirements
Some travel annually, which can include in-person training, team meet-ups, and strategy meetings
Service Delivery team members may travel based on business and client needs

View full job page →

11d ago

Application Security Engineer

Veilant Tysons, VA

Tysons, VA

11d ago

$115k - $145k/yr Full time Application Security Code Security Cybersecurity Tools

Apply Now

Job Description

Veilant is seeking an Application Security Engineer to validate, secure, and continuously improve software developed by internal and partner engineering teams.

Responsibilities

Audit software releases across major and minor cycles to intercept and remediate security flaws before deployment.
Analyze source code to identify, isolate, validate, and contextualize vulnerabilities in complex application codebases.
Build safe proof-of-concept examples to demonstrate exploitation paths and verify real-world impact.
Contextualize findings using application business logic, user workflows, data sensitivity, and production use cases.
Author remediation guidance and collaborate with development teams on patches, controls, or architectural mitigations.
Intercept and analyze application-layer network traffic using tools such as Burp Suite or similar intercepting proxies.
Inspect encrypted payloads, API calls, and authentication flows.
Assess and help secure core architectures across REST APIs, SQL databases, PostgreSQL, JWT/OAuth, identity providers, and token-based authentication mechanisms.
Perform threat modeling for web applications based on use cases, data flows, user roles, trust boundaries, and production environments.
Improve DevSecOps pipelines by integrating, tuning, and operationalizing SAST, DAST, SCA, IaC scanning, secrets detection, and container security tooling.
Support container runtime security efforts using monitoring and runtime protection tools such as Falco, NeuVector, or similar technologies.
Create standardized security reporting that translates technical findings into clear risk narratives for engineering teams and executive stakeholders.
Build a repeatable AppSec review process for major and minor software releases to help teams identify and resolve security issues before deployment.
Integrate and improve SAST, DAST, and SCA checks in CI/CD pipelines so security testing is part of the development lifecycle.
Establish threat modeling practices using common frameworks and apply them to Veilant’s Angular front-end, Java Spring Boot back-end, REST APIs, SQL databases, and authentication flows.
Partner with engineering and software teams to strengthen secure coding practices through collaborative reviews and practical remediation guidance.
Implement container runtime security best practices, including visibility, monitoring, and runtime protections for containerized workloads.
Write standardized security reports that communicate risk, impact, and remediation steps for both executive-level stakeholders and engineering teams.

Requirements

Ability to obtain a Security Clearance.
2+ years of software development experience in Java.
Hands-on experience reviewing or securing applications built with Java Spring Boot, Angular, REST APIs, SQL databases, and PostgreSQL.
Working knowledge of authentication and authorization technologies, including JWT, OAuth, identity providers, Entra, Keycloak, and token-based access models.
Experience intercepting, decrypting, manipulating, and analyzing web or application network traffic.
Demonstrated ability to find, validate, and explain vulnerabilities in a real codebase.
Familiarity with CI/CD tools such as GitLab CI, Azure DevOps, or GitHub Actions.
Experience with containerized environments and orchestration tools such as Kubernetes.
Exposure to infrastructure-as-code and container scanning tools such as Trivy, Kubesec, or similar technologies.
Understanding of cloud hosting environments such as Azure or AWS.
Familiarity with secrets management tools such as GitLab Secrets Manager, AWS KMS, Azure Key Vault, or Ansible Vault.
Experience with automated application security testing, including SAST, DAST, and SCA.
Familiarity with runtime security and monitoring tools for containers, such as Falco, NeuVector, or similar platforms.
Hands-on web security testing experience using Burp Suite or comparable tooling.
Strong written communication skills, including the ability to write reports for both technical and non-technical audiences.
OSWE, OSCP, and/or GXPN certifications are highly desirable.

Technologies

Java, Java Spring Boot, Angular
REST APIs, SQL databases, PostgreSQL
JWT, OAuth, Entra, Keycloak
Burp Suite
SAST, DAST, SCA, IaC scanning, secrets detection, container security tooling
Falco, NeuVector
CI/CD: GitLab CI, Azure DevOps, GitHub Actions
Kubernetes
Trivy, Kubesec
Azure, AWS
GitLab Secrets Manager, AWS KMS, Azure Key Vault, Ansible Vault
OSWE, OSCP, GXPN

Benefits

Flexible PTO + holidays
Generous 401k match benefit up to 10%, with an automatic 3% safe harbor contribution and additional matching based on employee contributions
Medical (HSA & PPO Plans Available), dental, vision, disability, and life insurance
Employer Contribution to Health Savings Account (HSA)
Learning & Development opportunities
Professional coaching services
Get the technology you want to do your job
Free daily snacks & drinks

Compensation and Work Location

Salary range: USD 115,000 - 145,000 per year
Location: Tysons, VA (onsite)

Physical Requirements

Must be able to remain in a stationary position 50% of the time; occasionally move about inside the office
Constantly work with computers and other information technology equipment
Ability to communicate information and ideas in a classroom style format; may stand at a podium for long periods of time

View full job page →

11d ago

Penetration Tester

Xcelerate Solutions Alexandria, VA

Alexandria, VA

11d ago

Full time Cybersecurity Tools Incident Response Information Security

Apply Now

Job Description

Xcelerate Solutions is hiring a Penetration Tester to support CyberPRIMES cybersecurity, privacy, records and information management, and related enterprise support for DHRA, including DMDC and OUSD(P&R), from Alexandria, VA onsite.

Responsibilities

Conduct Government-selected penetration-testing assessments and threat-hunting exercises following CSD-SOP-054 and NIST SP 800-115.
Create test plans and testing methodologies, execute assessments, and produce post-assessment out-briefs and final reports.
Support cooperative testing with cyber-tool administrators, SOC and incident-response analysts, and SIEM content developers to validate detection and alerting.
Perform pre-audit penetration testing.
Maintain Government-furnished penetration-testing laptops and tools.
Research emerging and existing threats and develop approaches to identify risk areas likely to be targeted by an intruder.
Use established penetration-testing methodologies and commercial or open-source offensive tools across networks, web applications, applications, and code.
Provide support to Red and Blue Team activities as needed.
Provide reporting and cooperative testing support for enterprise cybersecurity efforts tied to DHRA, including DMDC and OUSD(P&R).

Requirements

Bachelor’s degree and 3 years of experience.
U.S. Citizen.
Active Secret clearance.
Secret clearance is required when assigned duties involve classified information or SIPRNet access.