Senior Federal Penetration Tester — Onsite in DC/NOVA

B&M Cyber; Washington (District of Columbia); On-site; USD 120,000 - 180,000; Full time

Job summary

B&M Cyber in Washington, DC is seeking an experienced Penetration Tester to support federal clients, planning and conducting hands-on testing across infrastructure, applications, cloud, and identity environments.

The role requires delivering actionable remediation recommendations, developing RoE and test plans, and communicating findings to technical and non-technical stakeholders. Candidates must be eligible for security clearance and willing to work onsite in DC or Northern Virginia.

Qualifications

• Experience independently planning, executing, documenting, and presenting complex penetration testing engagements.
• Ability to provide a past performance report or comparable documentation that demonstrates competency as a penetration tester.
• At least five (5) years of hands-on penetration testing experience across infrastructure, application, cloud, and identity environments.
• Current Offensive Security Certified Professional (OSCP or OSCP+) or GIAC Penetration Tester (GPEN) certification, or equivalent (GXPN, OSEP).
• Ability to read and use results of security testing tools, perform false-positive analysis and validation, and communicate results and remediation actions to technical and non-technical audiences.
• Strong knowledge of network, application, cloud, and identity security and standard penetration testing tools.
• Strong analytical, problem-solving, written and verbal communication, technical writing, and documentation skills.

Responsibilities

• Identify and document vulnerabilities, misconfigurations, and compliance issues through thorough examination of external and internal infrastructure, systems, and security controls.
• Develop and execute Rules of Engagement (RoE), test plans, and SOPs aligned with client requirements and testing boundaries.
• Plan, scope, conduct, and document penetration testing across internal and external networks, web applications, APIs, databases, cloud services, Active Directory, and other identity technologies.
• Perform the full testing lifecycle, from non-intrusive scanning to exploitation and post-exploitation activities within the RoE.
• Analyze findings, identify attack paths, assess impact, and recommend practical remediation.
• Prepare accurate, technical reports describing findings and remediation, and present results to developers, admins, project managers, and senior Government stakeholders.
• Safeguard sensitive information encountered during testing in accordance with client security policies.
• Manage assignments, changing priorities, deadlines, and coordinate with stakeholders to resolve risks and issues.
• Contribute to continuous improvement of testing methodologies, tools, and frameworks, and mentor others.

Skills

Penetration testing

OSCP/GPEN

Burp Suite

Nessus

Metasploit

Nmap

PowerShell

Python

Technical writing

Communication

Team collaboration

Education

Bachelor's degree in Cybersecurity or related field

Tools

Burp Suite

Metasploit

Nessus

Nmap

BloodHound

Impacket

Job description

B&M Cyber in Washington, DC is seeking an experienced Penetration Tester to support federal clients, planning and conducting hands-on testing across infrastructure, applications, cloud, and identity environments.

The role requires delivering actionable remediation recommendations, developing RoE and test plans, and communicating findings to technical and non-technical stakeholders. Candidates must be eligible for security clearance and willing to work onsite in DC or Northern Virginia.