Penetration Tester III

Socket.dev; Springfield (VA); Hybrid; USD 140,000 - 175,000; Full time

Job summary

Agile Defense, based in the United States, seeks a Senior Cyber Threat Emulation SME to support a federal Agency from its hybrid Springfield, VA location. The role covers full-spectrum offensive security operations within a purple team, from initial infection vectors to final reports.

The candidate will develop targeted exploits, write scripts, analyze threat data, and brief leadership on findings, risk, and recommended mitigations. Top Secret/SCI eligibility and OSCP/GPEN are required.

Qualifications

• 7+ years in cyber offensive ops, red team work, and/or Penetration Testing.
• Active Top Secret Clearance and SCI Eligibility.
• Strong analytical and technical skills in computer network defense operations.
• Ability to develop rules, filters, views, signatures, countermeasures and scripts.

Responsibilities

• Research and stay up to date with emerging threats and Threat Emulation methodologies.
• Develop and write customized scripts (Python, PowerShell or other) to simulate attacker behavior.
• Provide reporting for threat emulation successes and brief leadership.
• Review collected monitoring and defense information for anomalies to support threat simulation.
• Engage with Agency offices to access information sources for Threat Emulation activities.

Skills

Threat Emulation

Red Team

Penetration Testing

Threat Detection

Python

PowerShell

OSCP/GPEN

Education

High School Diploma or equivalent

Bachelor’s Degree not required but preferred

Tools

Python

PowerShell

SIEM/Splunk

Job description

About Agile Defense

At Agile Defense we know that action defines the outcome and new challenges require new solutions. That’s why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next.

Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility—leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation’s vital interests.

Requisition #: 1749

Job Title: Penetration Tester III

Location: Hybrid, Springfield, VA

Clearance Level:

Top Secret / SCI, Must Have Clearance to Start

Required Certification(s):

OSCP, GPEN or other related cybersecurity cert

Job Description

Agile Defenseis currently seeking a SeniorCyber Threat Emulation (TE) SME to support a federal Agency. The threat emulation program is part of a purple team that provides comprehensive computer network defense, incident response, and other cybersecurity support through monitoring and analysis of potential threat activity targeting the enterprise. This SME will run the offensive portion of the purple team.

The TE SME, as part of a small team, will have full latitude to execute penetration activity from initial infection vector to final report – the full spectrum of offensive operations, the entire killchain. The advanced TE SME advances organizational understanding over risks and potential exposures related to software, system, and network weakness using advanced security testing and auditing methods. This senior level cyber TE analysts engage with senior leadership to identify, report, and perform real-world threat activity simulation attacks, such as those used by our nation’s adversaries, in order to train and measure the effectiveness of the people, processes, and technology used to defend Agency networks and systems. This full spectrum SME will develop and write targeted exploits and benign malware, pivoting through enterprise systems, and emulating malicious actors. This SME uses malicious means to get into a position where he/she could disrupt the operations of Agency systems or maintain persistence for the purposes of further exploitation.

Additionally, the ideal candidate is familiar withintrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and federal agency SOC procedures. Corporate duties such as solution proposals.

In support of this task and the activities listed above, the Contractor shall:

• Research and remain up to date with emerging threats and Threat Emulation methodologies.
• Map Cyber Key Terrain and generate priority target lists.
• Engage in project meetings to gain knowledge of changes to the infrastructure and information sources that will aid the Threat Emulation Team.
• Conduct research on commercial and open-source tools that may address capability gaps in detecting and/or blocking malicious activity.
• Be familiar with development of attack vectors, system and infrastructure reconnaissance, collection of open‐source intelligence, enumeration, and foot-printing of target networks and services.
• Conduct in-depth analysis of computer network and host data to determine threat patterns and unusual behaviors to identify potential TTPs employed by adversarial APTs and identify related APT activities and malware within operational networks and systems.
• Use TTPs to emulate real-world threats in order to train and measure the effectiveness of the people, processes, and technology used to defend environments.
• Engage with other Agency offices to gain access to various information sources in support of Threat Emulation activities.
• Review collected monitoring and defense information that will be used as inputs or indicators of abnormalities or malicious activity for threat simulation development.
• Generate threat intelligence indicators during emulation operations as part of research and apply and fine tune them across the enterprise network.
• Develop and write (Python, Rust, PowerShell or your language of choice) customized scripts, payloads, and system backdoor emulations to simulate attacker behavior within various stages of attack activity, detection evasions, lateral movements, or exfiltration attempts.
• Utilize the Cyber Threat Framework (ODNI) and production of Threat Emulation findings in said format.
• Provide reporting for and brief all threat emulation successes at the completion of each approved emulation operation, which includes delineating evidence discovered, report writing, and briefing leadership.
• Provide recommendations on enhancing Threat Emulation capabilities

Education and Background

• High School Diploma or equivalent required

Years of Experience

7+ years

Required Skills

• Threat Emulation SMEs must have at least 7 years of experience in cyber offensive ops, red team work, and/or Penetration Testing.
• Active Top Secret Clearance and SCI Eligibility.
• Strong analytical and technical skills in computer network defense operations.
• Prior experience and ability with analyzing threat intelligence/information or providing cyber defense analytical capabilities to assist in proactive identification of threats, events, and incidents.
• Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support efforts.
• Strong logical/critical thinking abilities, especially analyzing vulnerability information and current adversarial TTPs and IOCs.
• Strong proficiency Report writing – a technical writing sample and technical editing test will be required if the candidate has no prior published intelligence analysis reporting, excellent verbal and written communications skills and ability produce clear and thorough security incident reports and briefings.
• Excellent organizational and attention to detail in tracking activities as part of overall Security Operation workflows or projects.
• Experience with the identification and implementation of defensive countermeasures or mitigating controls for deployment and implementation in the enterprise network environment.
• Experience in mentoring and training analysts or Red Team members.
• Knowledge of different operational threat environments (e.g., first generation [script kiddies], second generation [non-nation state sponsored], and third generation [nation state sponsored])
• Knowledge of general attack stages (e.g., foot-printing and scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks, etc.)
• Knowledge of incident categories, incident responses, and timelines for responses.

Preferred Skills

• One or more certifications for CND Analysts:GCIA, GCED, GCFE, GCTI, GNFA, GCIH, CND, ECSA, OSCP, OSEE, OSCE.
• One or more certifications for malware or forensic analysts:GCFA, GCFE, GREM, CHFI.
• Existing Subject Matter Expertise of Advanced Persistent Threator Emerging Threats.
• Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, Electrical Engineering, or related field of study is NOT required but preferred.
• Expertise on policies, industry trends, techniques related to penetration testing.
• Experience with one or more of the following topics or technologies Network Threat Hunting, Big Data Analytics (Splunk), Endpoint Threat Detection, SIEM,, workflow and ticketing, Intrusion Detection System.
• Familiarity with scripting languages (BASH, PowerShell, Python, etc.) or software development frameworks (.NET).

Working Conditions

• WORKING CONDITIONS Environmental Conditions
• General office environment. Work is generally sedentary in nature, but may require standing and walking for up to 10% of the time. The working environment is generally favorable. Lighting and temperature are adequate, and there are not hazardous or unpleasant conditions caused by noise, dust, etc. Work is generally performed within an office environment, with standard office equipment available.
• Strength Demands
• Sedentary – 10 lbs. Maximum lifting, occasional lift/carry of small articles. Some occasional walking or standing may be required. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.
• Physical Requirements
• Ability to sit for extended periods. Repetitive Motion; Use Hands / Fingers to Handle or Feel

Our Core Values

Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together.

What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are.

• Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do.
• Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated.
• Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support.
• Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task.
• Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges.
• Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success.