Penetration Tester

SAIC; Austin (TX); On-site; USD 110,000 - 160,000; Full time

Job summary

SAIC in the United States seeks a Penetration Tester to join our offensive security practice supporting a major state and local government customer. You will perform web, network, and mobile assessments (iOS/Android), deliver high‑quality findings, and translate risk into actionable remediation for executives and technical teams.

This role requires deep technical knowledge, strong report writing, and the ability to lead engagements from scoping to reporting.

Qualifications

• Bachelor's degree in a relevant field and 9+ years of experience or Master’s with 7+ years; PhD/JD with 4+ years preferred.
• U.S. citizenship and ability to pass CJIS background check and maintain clearance.
• Strong knowledge of OWASP WSTG and Top 10 with hands-on testing across web/mobile

Responsibilities

• Deliver high-quality penetration tests across client environments using black box, white box, web app or mobile methodologies.
• Produce clear, client-ready reports with risk context and remediation guidance for technical teams and executives.
• Support mobile assessments (iOS/Android) and perform security assessments using MASVS/MSTG and related tooling.
• Lead engagements from scoping through reporting and contribute to strategy and enterprise cybersecurity guidance.

Skills

OWASP WSTG

OWASP Top 10

Red-team / ethical hacking

Cloud security architecture

Vulnerability assessment

Mentoring / leadership

Education

Bachelor's degree in CS/IT/Security

Master's degree in a relevant field

PhD or JD preferred

Tools

Burp Suite Pro

FFUF

SQLMap

Nuclei

Frida

Objection

MobSF

ADB

Job description

Science Applications International Corporation (SAIC) is seeking a Penetration Tester to join our offensive security practice supporting a major state & local government customer. This role sits at the intersection of hands‑on technical execution and cybersecurity leadership and it's built around delivering real impact for clients who depend on us to find what others miss. Web application & Network penetration testing is the core of what you'll do every day, and we're looking for someone who brings both technical depth and genuine curiosity to every engagement. Beyond web and network pentesting you'll contribute to our mobile application testing practice (iOS and Android), support ethical hacking operations, and provide strategic guidance on enterprise cyber architecture and cloud security. This position reports to the Security Assessments Manager. This is a role where your contributions are visible, your growth is intentional, and your voice matters to the team and to the clients we serve.

Essential duties of this position include:

• Deliver high-quality penetration tests across a range of client environments, applying black box, white box, web app or mobile methodologies as needed and aligned to NIST standardsIndependently manage engagement workloads from scoping through reporting, with a consistent focus on qualityProduce clear, well-structured technical reports that communicate findings, risk context, and actionable remediation guidance to both technical teams and executive stakeholders and translate complex technical documentation into terms any stakeholder can act onSupport and contribute to mobile application security assessments (iOS and Android) using the OWASP MASVS/MSTG framework, with the expectation of growing mobile capabilities over timePerform strategic planning and management in cybersecurity and digital forensics in alignment with the National Initiative for Cybersecurity Education (NICE) FrameworkAddress a wide range of security issues including architectures, firewalls, electronic data traffic, and network accessResearch, evaluate, and recommend new security tools, techniques, and technologies; utilize COTS/GOTS and custom tools to scan, identify, contain, mitigate, and remediate vulnerabilities and intrusionsApply expert engineering knowledge to design, develop, and implement security solutions across enterprise engagementsConfidently present findings to clients whether it is walking a developer through a vulnerability chain or explaining business risk to a CISO in the same afternoonAct as a spokesperson and advisor on advanced technical projects and research; participate with senior management to establish strategic plans and objectivesActively share knowledge with teammates, contribute to internal tooling and methodology improvements, and help close skill gaps across the practiceStay current on emerging vulnerabilities, attack techniques, and industry developments and bring that knowledge back to the team

Qualifications

• Typical Education and Experience:Bachelors and nine (9) years or more experience; Masters and seven (7) years or more experience; PhD or JD and four (4) years or more related experience. Additional experience considered in lieu of degreeCandidates must be a US Citizen and able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout employment termRequired Experience:Advanced technical knowledge in cybersecurity and digital forensicsStrong working knowledge of the OWASP WSTG and OWASP Top 10 — not just the list, but how to find and exploit the vulnerabilitiesProficiency with standard web application testing tools (e.g., Burp Suite Pro, FFUF, SQLMap, Nuclei)Working familiarity with mobile application testing concepts and tooling (e.g., Frida, Objection, MobSF, ADB)Proven experience in red‑team­ing, ethical hacking, and cloud security architectureProficiency in malware reverse engineering and enterprise cyber architectureStrong background in addressing security issues related to architectures, firewalls, electronic data traffic, and network accessExperience researching, evaluating, and recommending new security tools and technologiesProficiency utilizing COTS/GOTS and custom tools for vulnerability managementDemonstrated ability to write professional, client‑ready penetration test reports with minimal revisionGWAPT certification required or strongly preferred; candidates holding OSCP, OSWE, or GWEB will also be consideredPreferred Experience:Hands‑on experience conducting iOS and/or Android application assessmentsFamiliarity with API security testing (REST, GraphQL, SOAP)Exposure to source code review as part of white box engagementsExperience presenting findings directly to client stakeholders, including senior leadershipParticipation with senior management to establish strategic plans and objectivesExperience working on unusually complex technical problems and providing innovative solutionsProven ability to work under consultative direction toward long‑range goals and objectivesExperience serving as an organizational spokesperson and advisor on advanced technical projectsKnowledge of applying advanced technical principles, theories, and concepts to develop new principles and conceptsExperience making decisions on administrative or project work matters to achieve program or organizational objectivesStrong background in developing advanced technological ideas and guiding them to final product developmentExperience influencing organizational image and technological capability through decision‑making and recommendations

Company Information

SAIC® is a premier mission integrator focused on advancing the power of technology and innovation to serve and protect our world. Our robust portfolio of offerings across the defense, space, intelligence, and civilian markets includes secure high‑end solutions in mission IT, enterprise IT, engineering services, and professional services. We integrate emerging technology, rapidly and securely, into mission critical operations that modernize and enable critical national imperatives. We are approximately 23,000 strong; driven by mission, united by purpose, and inspired by opportunities. SAIC is an Equal Opportunity Employer. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $7.3 billion. For more information, visit saic.com. For ongoing news, please visit our newsroom.