Penetration Tester

SAIC; Texas; Hybrid; USD 120,000 - 160,000; Full time

Job summary

Science Applications International Corporation (SAIC) seeks a Senior Penetration Tester to join our offensive security practice supporting a major state & local government customer. This role blends hands-on testing with cybersecurity leadership.

You will conduct web and mobile app testing (iOS/Android), contribute to secure architectures, and deliver clear reports to technical teams and executives. CJIS clearance and US citizenship are required.

Qualifications

• Advanced technical knowledge in cybersecurity and digital forensics.
• Strong working knowledge of OWASP WSTG and OWASP Top 10 with exploitation know-how.
• Proficiency with web testing tools: Burp Suite Pro, FFUF, SQLMap, Nuclei.
• Familiarity with mobile testing concepts and tooling: Frida, Objection, MobSF, ADB.
• Proven experience in red-teaming, ethical hacking, and cloud security architecture.
• Proficiency in malware reverse engineering and enterprise cyber architecture.

Responsibilities

• Deliver high-quality penetration tests across client environments using multiple methodologies.
• Independently manage engagements from scoping to reporting with quality focus.
• Produce clear, structured reports communicating findings and remediation guidance.
• Support mobile app security assessments (iOS/Android) using OWASP MASVS/MSTG.
• Align security work with NICE Framework and enterprise cyber architecture.
• Address security issues across architectures, firewalls, data traffic, and networks.
• Evaluate tools and technologies; use COTS/GOTS and custom tools to remediate vulnerabilities.
• Present findings to clients including developers and CISOs.
• Share knowledge, improve internal tooling, and mentor teammates.

Skills

Cybersecurity expertise

Digital forensics

OWASP Top 10

Burp Suite Pro

FFUF

SQLMap

Nuclei

Frida

Objection

MobSF

ADB

Red-teaming

Cloud security

Report writing

Client communication

Education

Bachelor’s degree + 9 years

Master’s degree + 7 years

PhD/JD + 4 years

Tools

Burp Suite Pro

FFUF

SQLMap

Nuclei

Frida

Objection

MobSF

ADB

Job description

Description

Science Applications International Corporation (SAIC) is seeking a Senior Penetration Tester to join our offensive security practice supporting a major state & local government customer. This role sits at the intersection of hands-on technical execution and cybersecurity leadership and it's built around delivering real impact for clients who depend on us to find what others miss.

Web application & Network penetration testing is the core of what you'll do every day, and we're looking for someone who brings both technical depth and genuine curiosity to every engagement. Beyond web and network pentesting you'll contribute to our mobile application testing practice (iOS and Android), support ethical hacking operations, and provide strategic guidance on enterprise cyber architecture and cloud security. This position reports to the Security Assessments Manager.

This is a role where your contributions are visible, your growth is intentional, and your voice matters to the team and to the clients we serve.

Essential duties of this position include:

• Deliver high-quality penetration tests across a range of client environments, applying black box, white box, web app or mobile methodologies as needed and aligned to NIST standards
• Independently manage engagement workloads from scoping through reporting, with a consistent focus on quality
• Produce clear, well-structured technical reports that communicate findings, risk context, and actionable remediation guidance to both technical teams and executive stakeholders and translate complex technical documentation into terms any stakeholder can act on
• Support and contribute to mobile application security assessments (iOS and Android) using the OWASP MASVS/MSTG framework, with the expectation of growing mobile capabilities over time
• Perform strategic planning and management in cybersecurity and digital forensics in alignment with the National Initiative for Cybersecurity Education (NICE) Framework
• Address a wide range of security issues including architectures, firewalls, electronic data traffic, and network access
• Research, evaluate, and recommend new security tools, techniques, and technologies; utilize COTS/GOTS and custom tools to scan, identify, contain, mitigate, and remediate vulnerabilities and intrusions
• Apply expert engineering knowledge to design, develop, and implement security solutions across enterprise engagements
• Confidently present findings to clients whether it is walking a developer through a vulnerability chain or explaining business risk to a CISO in the same afternoon
• Act as a spokesperson and advisor on advanced technical projects and research; participate with senior management to establish strategic plans and objectives
• Actively share knowledge with teammates, contribute to internal tooling and methodology improvements, and help close skill gaps across the practice
• Stay current on emerging vulnerabilities, attack techniques, and industry developments and bring that knowledge back to the team

Qualifications

Typical Education and Experience:

• Bachelors and nine (9) years or more experience; Masters and seven (7) years or more experience; PhD or JD and four (4) years or more related experience. Additional experience considered in lieu of degree
• Candidates must be a US Citizen and able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout employment term

Required Experience:

• Advanced technical knowledge in cybersecurity and digital forensics
• Strong working knowledge of the OWASP WSTG and OWASP Top 10 — not just the list, but how to find and exploit the vulnerabilities
• Proficiency with standard web application testing tools (e.g., Burp Suite Pro, FFUF, SQLMap, Nuclei)
• Working familiarity with mobile application testing concepts and tooling (e.g., Frida, Objection, MobSF, ADB)
• Proven experience in red-teaming, ethical hacking, and cloud security architecture
• Proficiency in malware reverse engineering and enterprise cyber architecture
• Strong background in addressing security issues related to architectures, firewalls, electronic data traffic, and network access
• Experience researching, evaluating, and recommending new security tools and technologies
• Proficiency utilizing COTS/GOTS and custom tools for vulnerability management
• Demonstrated ability to write professional, client-ready penetration test reports with minimal revision
• GWAPT certification required or strongly preferred; candidates holding OSCP, OSWE, or GWEB will also be considered

Preferred Experience:

• Hands-on experience conducting iOS and/or Android application assessments
• Familiarity with API security testing (REST, GraphQL, SOAP)
• Exposure to source code review as part of white box engagements
• Experience presenting findings directly to client stakeholders, including senior leadership
• Participation with senior management to establish strategic plans and objectives
• Experience working on unusually complex technical problems and providing innovative solutions
• Proven ability to work under consultative direction toward long-range goals and objectives
• Experience serving as an organizational spokesperson and advisor on advanced technical projects
• Knowledge of applying advanced technical principles, theories, and concepts to develop new principles and concepts
• Experience making decisions on administrative or project work matters to achieve program or organizational objectives
• Strong background in developing advanced technological ideas and guiding them to final product development
• Experience influencing organizational image and technological capability through decision-making and recommendations

Target salary range: $120,001 - $160,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.