Junior Penetration Tester

Science Applications International Corp.; EE. UU.; Presencial; USD 85.000 - 110.000; Jornada completa

Descripción de la vacante

Science Applications International Corp. (SAIC) is seeking a Junior Penetration Tester to support a major state and local government customer. Focus on web application and network penetration testing with mentorship from senior testers.

You will plan and execute assessments, identify vulnerabilities, validate findings, and document results in clear reports. You will work with experienced testers, grow your skills through hands‑on practice, and align your growth with the NICE Framework.

Formación

• Foundational knowledge of cybersecurity concepts, including networking and operating systems.
• Familiar with WSTG and OWASP Top 10 to identify vulnerabilities.

Responsabilidades

• Conduct penetration tests across client environments using web, network, and mobile targets.
• Manage assigned tasks within engagements from scoping through final reporting.
• Produce clear, structured reports with risk context and remediation guidance.
• Contribute to iOS/Android security assessments and grow mobile testing skills.
• Apply security fundamentals to identify weaknesses in client environments.
• Research and evaluate new tools, techniques, and technologies.

Conocimientos

Foundational cybersecurity knowledge

Strong written communication

Team collaboration

Problem-solving mindset

Educación

Bachelor's degree preferred

Herramientas

Burp Suite

Tenable

Frida

MobSF

PortSwigger Web Security

Descripción del empleo

Science Applications International Corporation (SAIC) is seeking a Junior Penetration Tester to join our offensive security practice supporting a major state and local government customer. This is an excellent opportunity for an early-career security professional who wants to build hands‑on experience while working on real‑world engagements that matter. As a Junior Penetration Tester, you will focus primarily on web application and network penetration testing. Working alongside experienced testers, you will plan and execute assessments, identify vulnerabilities, validate findings, and document results in clear, actionable reports. You'll bring curiosity, persistence, and a strong desire to learn, and we'll give you the mentorship and room to grow your skills. This position reports to the Security Assessments Manager.

Responsibilities

• Assessment Delivery: Conduct penetration tests across a range of client environments, applying black box and white box methodologies for web, network, and mobile targets, aligned to NIST standards.
• Engagement Support: Manage your own assigned tasks and workload within engagements, from scoping support through final reporting, with guidance from senior testers and a consistent focus on quality.
• Reporting: Produce clear, well-structured technical reports that communicate findings, risk context, and actionable remediation guidance. Learn to translate complex technical details into terms that both technical teams and executive stakeholders can act on.
• Mobile Security: Contribute to iOS and Android application security assessments, with the opportunity to grow your mobile testing capabilities over time.
• Security Fundamentals: Apply your knowledge of security architectures, firewalls, network traffic, and access controls to identify and assess weaknesses across client environments.
• Tools and Techniques: Use COTS, GOTS, and custom tools to scan for, identify, and validate vulnerabilities. Help research and evaluate new tools, techniques, and technologies, and recommend improvements to the team.
• Client Communication: Develop your ability to present findings with confidence, whether walking a customer through a vulnerability chain or helping explain business risk to their leadership.
• Professional Development: Align your growth with the NICE Framework and build foundational skills in cybersecurity and digital forensics through mentorship, training, and hands‑on practice.
• Team Contribution: Share what you learn with teammates, contribute to internal tooling and methodology improvements, and help close skill gaps across the practice.
• Continuous Learning: Stay current on emerging vulnerabilities, attack techniques, and industry developments, and bring that knowledge back to the team.

Required Education and Qualifications

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field is preferred but not required. Equivalent hands‑on experience, such as labs, CTFs, internships, or personal projects, may be considered in lieu of a degree.

Candidates must be able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout the term of employment.

Required Experience

• Foundational knowledge of cybersecurity concepts, including networking, operating systems, and common attack techniques.
• Working knowledge of the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10, including how to identify and exploit common vulnerabilities in lab or practical settings.
• Hands‑on familiarity with standard web application testing & vuln scanning tools (e.g., Burp Suite, Tenable etc.).
• Basic understanding of network security concepts, including firewalls, network traffic, and access controls.
• Ability to write clear, organized technical documentation, with a willingness to incorporate feedback and improve report quality.
• Strong curiosity, problem‑solving skills, and a drive to keep learning.
• One of the following certifications is strongly preferred: GWAPT & OSCP. Candidates holding or actively pursuing the above or PNPT, PenTest+, PJPT, eJPT, OSEP/OSWE/OSED, or GWEB will also be considered.

Preferred Experience

• Exposure to mobile application testing concepts and tools (e.g., Frida, Objection, MobSF, ADB), including any hands‑on iOS or Android assessment experience.
• Familiarity with API security testing (REST, GraphQL, SOAP).
• Exposure to source code review as part of white box testing.
• Experience with CTFs, bug bounty programs, home labs, or platforms such as Hack The Box, TryHackMe, or PortSwigger Web Security Academy.
• Basic scripting skills (e.g., Python, Bash, PowerShell) to automate tasks.
• Introductory exposure to cloud security concepts, digital forensics, or reverse engineering.
• Experience presenting technical information to peers or stakeholders, or interest in building this skill.
• Ability to work collaboratively under the guidance of senior team members.