Mid-Level Penetration Tester

Science Applications International Corp.; United States; On-site; USD 100,000 - 160,000; Full time

Job summary

Science Applications International Corp. (SAIC) is seeking a Mid-Level Penetration Tester to join our offensive security practice supporting major state and local government customers.

You will independently conduct security assessments across web applications, networks, APIs, mobile apps, and cloud-hosted systems, delivering actionable remediation guidance. The role requires 5+ years of hands-on cybersecurity experience, strong knowledge of OWASP/WSTG, and experience with Burp Suite, Nmap,

Qualifications

• 5+ years hands-on cybersecurity experience, including 2+ years conducting penetration testing or offensive security assessments.
• Strong knowledge of web application security testing methodologies, including OWASP WSTG and OWASP Top 10.
• CJIS background investigation eligibility and ability to pass CJIS background check.

Responsibilities

• Independently perform penetration testing engagements against web applications, networks, APIs, mobile applications, wireless environments, and cloud-hosted systems using black-box and white-box methods.
• Coordinate with senior team members, project managers, and clients to ensure successful assessment delivery.
• Produce comprehensive technical reports communicating vulnerabilities, business impact, and remediation guidance.
• Lead and mentor junior testers when appropriate.

Skills

Penetration testing

Security assessments

Client communication

Reporting

Education

Bachelor's degree in Cybersecurity or related field

CJIS background check eligibility

OSCP, GWAPT, PNPT, GPEN, OSEP, OSWE, PenTest+ or eJPT/eCPPT certifications (listed)

Tools

Burp Suite Pro

Nmap

Nessus/Tenable

Metasploit

Job description

Science Applications International Corporation (SAIC) is seeking a Mid-Level Penetration Tester to join our offensive security practice supporting major state and local government customers. This role is ideal for a cybersecurity professional with hands-on penetration testing experience who can independently conduct security assessments, identify vulnerabilities, and deliver actionable recommendations to clients. As a Mid-Level Penetration Tester, you will lead and support engagements involving web application, network, API, mobile, and infrastructure security assessments. You will work closely with clients, security engineers, and fellow testers to evaluate security controls, simulate real-world attack scenarios, and help organizations strengthen their security posture. The ideal candidate combines strong technical expertise with effective communication skills and a passion for offensive security. This position reports to the Security Assessments Manager.

Responsibilities

Assessment Execution

• Independently perform penetration testing engagements against web applications, networks, APIs, mobile applications, wireless environments, and cloud-hosted systems utilizing both black-box and white-box methodologies.
• Conduct testing activities aligned with NIST, OWASP, PTES, and industry-recognized security assessment frameworks.
• Develop attack paths, validate vulnerabilities, and demonstrate exploitability while maintaining engagement objectives and timelines.

Engagement Leadership

• Manage assigned testing engagements from planning and scoping support through execution, reporting, and customer debriefs.
• Coordinate with senior team members, project managers, and clients to ensure successful assessment delivery.
• Provide technical guidance and mentorship to junior team members when appropriate.

Reporting and Analysis

• Produce comprehensive technical reports that clearly communicate vulnerabilities, business impact, attack scenarios, and remediation recommendations.
• Present findings to technical teams, management, and executive stakeholders.
• Assist customers in understanding risk priorities and developing remediation strategies.

Advanced Security Testing

• Conduct web application security assessments utilizing the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10 methodologies.
• Perform API security assessments involving REST, GraphQL, SOAP, and modern authentication mechanisms.
• Conduct mobile application security testing on iOS and Android platforms.
• Participate in source code reviews and secure code assessments as part of white-box testing engagements.

Tool Development and Research

• Utilize commercial, government, open-source, and custom-developed security tools to identify, exploit, and validate vulnerabilities.
• Develop and maintain scripts, utilities, and testing methodologies to improve assessment efficiency and effectiveness.
• Evaluate emerging attack techniques, vulnerabilities, and security technologies, incorporating findings into team practices.

Client Engagement

• Serve as a trusted advisor to customers by communicating technical findings in both technical and business-focused terms.
• Present assessment outcomes and remediation guidance during customer briefings and readout sessions.
• Build and maintain positive customer relationships through professional engagement delivery.

Continuous Improvement

• Remain current on evolving threats, offensive security techniques, emerging vulnerabilities, and industry best practices.
• Contribute to internal research projects, methodology enhancements, tool development initiatives, and knowledge-sharing activities.
• Support cybersecurity capability growth aligned to the NICE Cybersecurity Workforce Framework.

Required Education and Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field; equivalency through relevant experience will be considered.
• Ability to successfully pass a CJIS Criminal Justice background investigation and maintain CJIS eligibility throughout employment.
• One or more industry-recognized penetration testing certifications preferred, such as: OSCP
• GWAPT
• PNPT
• GPEN
• OSEP
• OSWE
• PenTest+
• eJPT/eCPPT

Required Experience

• 5+ years of hands‑on cybersecurity experience, including 2+ years conducting penetration testing or offensive security assessments.
• Strong knowledge of web application security testing methodologies, including OWASP WSTG and OWASP Top 10.
• Experience conducting authenticated and unauthenticated network penetration tests.
• Proficiency with industry-standard testing tools, including Burp Suite Professional, Nmap, Nessus/Tenable, Metasploit, and similar platforms.
• Experience identifying, exploiting, validating, and documenting security vulnerabilities.
• Working knowledge of network protocols, operating systems, Active Directory, authentication mechanisms, and common enterprise architectures.
• Experience creating professional technical reports and presenting findings to technical and non-tech