Penetration Tester

Cybersecurity Jobs; Washington (District of Columbia); On-site; USD 140,000 - 165,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) retirement plan

Paid time off

Paid parental leave

Life and disability insurance

Flexible spending accounts

Commuter benefits

Tuition reimbursement

Job summary

Koniag Government Services seeks a Penetration Tester to support authorized assessments for a government client in Washington, DC. The role is hybrid.

You will conduct tests on networks, web and mobile apps, and infrastructure; use Metasploit, Burp Suite, Nmap, Wireshark; produce detailed reports and remediation guidance.

Qualifications

• Bachelor’s degree in CS, Cybersecurity, IT, or related field; equivalent experience may be considered.
• ],
• job_responsibilities_description:[

Responsibilities

• Conduct authorized testing on networks, web and mobile apps, and infrastructure.
• Perform vulnerability assessments and controlled exploitation.
• Develop test plans covering recon, scanning, exploitation, and post-exploitation.
• Use tools like Metasploit, Burp Suite, and Nmap to evaluate security.
• Write custom scripts to automate testing and support exploit development.
• Produce detailed reports with risk ratings, methods, and remediations.
• Communicate findings to technical teams and leadership.
• Collaborate with admins, developers, and security teams to remediate.
• Support social engineering assessments when required.
• Stay aware of threats and participate in red/blue/purple team exercises.
• Ensure testing follows rules of engagement and policies.
• Support continuous monitoring and enterprise-wide assessments.

Skills

Penetration testing

Vulnerability assessment

Scripting (Python)

Communication skills

Networking knowledge

Windows & Linux admin

Independent multitasking

Report writing

Threat awareness

Education

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field

Tools

Metasploit

Burp Suite

Nmap

Nessus

Python

Bash

PowerShell

Wireshark

Kali Linux

Kubernetes

AWS

Azure

GCP

SAST

DAST

NIST 800-53

FedRAMP

RMF

Job description

Koniag Government Services seeks a Penetration Tester to support authorized cybersecurity assessment initiatives for KOS and a government customer in Washington, DC (hybrid).

Responsibilities

• Conduct authorized penetration testing on networks, web applications, mobile applications, and infrastructure to uncover security weaknesses.
• Perform vulnerability assessments and attempt exploitation of identified vulnerabilities in a controlled, authorized manner.
• Develop and execute test plans covering reconnaissance, scanning, exploitation, and post-exploitation activities.
• Use industry-standard tools and techniques, including Metasploit, Burp Suite, and Nmap (as well as Nessus) to evaluate system security.
• Write custom scripts and tools to automate testing and support exploit development when needed.
• Produce detailed technical reports with risk ratings, exploitation methods, and remediation recommendations.
• Communicate findings and recommendations to technical teams and leadership in an actionable format.
• Collaborate with system administrators, developers, and security teams to validate and remediate vulnerabilities.
• Support social engineering assessments, including phishing campaigns, when required.
• Maintain awareness of emerging threats, attack vectors, and current penetration testing methodologies.
• Participate in red team / blue team exercises and support purple team collaboration efforts.
• Ensure all testing activities follow rules of engagement, legal requirements, and organizational policies.
• Support continuous monitoring and enterprise-wide security assessment activities.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field from an accredited institution; equivalent experience may be considered in lieu of a degree.
• 3-5 years of experience in penetration testing, ethical hacking, or offensive security roles.
• Demonstrated experience conducting network, web application, and/or wireless penetration tests.
• Experience using scripting languages such as Python, Bash, or PowerShell for tool development and automation.
• Exceptional communication skills (written and oral) to translate complex technical findings into actionable recommendations for technical and non-technical stakeholders.
• Strong understanding of networking protocols, Windows and Linux operating systems, and system architectures.
• Hands‑on experience with penetration testing tools, including Metasploit, Burp Suite, Nmap, Wireshark, and Kali Linux.
• Knowledge of vulnerability frameworks: OWASP Top 10, MITRE ATT&CK, and CVSS scoring.
• Experience performing both internal and external penetration tests.
• Ability to think creatively and use an attacker mindset to identify non‑obvious weaknesses.
• Strong grasp of security concepts, including encryption, authentication, and access control mechanisms.
• Ability to work independently and manage multiple engagements under tight deadlines.
• Strong report writing skills with attention to detail and accuracy.
• Ability to obtain and maintain a Public Trust Clearance.

Technologies

• Metasploit
• Burp Suite
• Nmap
• Nessus
• Python
• Bash
• PowerShell
• Wireshark
• Kali Linux
• OWASP Top 10
• MITRE ATT&CK
• CVSS
• Windows
• Linux
• AWS
• Azure
• GCP
• SAST
• DAST
• NIST 800-53
• FedRAMP
• RMF
• Kubernetes

Benefits

• Medical, dental, and vision insurance
• 401(k) retirement plan
• Paid time off
• Paid parental leave
• Life and disability insurance
• Flexible spending accounts
• Commuter benefits
• Tuition reimbursement

Preferred / Desired Skills

• Experience supporting federal government IT environments for security assessments.
• Industry certifications such as OSCP, GPEN, CEH, or CISSP.
• Experience with cloud security assessments (AWS, Azure, GCP).
• Familiarity with red team operations and adversary emulation techniques.
• Knowledge of secure coding practices and application security testing (SAST/DAST).
• Experience with container and Kubernetes security testing.
• Familiarity with compliance frameworks such as NIST 800-53, FedRAMP, or RMF.

Location: Washington, DC (hybrid). Salary: USD 140,000 - 165,000 per year.