Senior Penetration Tester

Tharros; Norfolk (VA); On-site; USD 110,000 - 190,000; Full time

Job summary

Tharros in Norfolk, VA is seeking a Senior Penetration Tester to support US Navy OT&E efforts onsite. You will build test plans, run pen tests and red team activities across lab and field environments, and deliver actionable results for mission-focused OT&E programs.

Responsibilities include OPTEVFOR planning, SOP development, tool usage, and documenting lessons learned. Strong communication and 6+ years in testing or red teaming are required.

Qualifications

• Minimum 6 years in penetration testing, red teaming, or exploitation development.
• Minimum 6 years leading red team operators to achieve test objectives.
• Required certifications: OSCP, OSCE, GX-PT, GXPM, PNPT, or HTB CPTS.
• Proficient with offensive tools including Metasploit, Cobalt Strike, Core Impact, Burp Suite, Nessus.
• Ability to validate tooling safety and effectiveness via source code.
• Excellent written and verbal communication skills.

Responsibilities

• Review OPTEVFOR cyber T&E concepts, SOPs, policies, and guidance.
• Develop 01D SOPs and DCAT authorization documentation per DoDI 8585.01.
• Submit requirements for equipment or cyber capabilities via the 01D tool approval process.
• Support the development and execution of TTPs for testing and Red Teaming.
• Research adversary TTPs and integrate findings into test planning.
• Identify attack surfaces and threat vectors across multiple environments.
• Lead test plan reviews and guide objective feasibility.
• Execute test events including CVP, adversarial assessments, and tabletop exercises.
• Utilize OPTEVFOR and NAO-approved tools such as Core Impact/Nmap/Burp/Nessus.
• Document lessons learned and deficiencies in risk sheets.

Skills

Penetration testing

Red team ops

Ethical hacking

OPTEVFOR knowledge

Exploits validation

Windows

Linux

Documentation

Threat analysis

Tools

Metasploit

Cobalt Strike

Core Impact

Burp Suite

Nessus

Nmap

BloodHound

Job description

Tharros is seeking a Senior Penetration Tester to support US Navy operational test and evaluation efforts from Norfolk, VA (onsite). In this role, you will help strengthen cyber test coverage by building test plans, executing penetration testing and red team activities across operational and lab environments, and delivering clear results for mission-focused OT and cyber OT&E.

Responsibilities

• Review and become proficient in OPTEVFOR cyber T&E concept of operations, SOPs, policies, and guidance.
• Maintain and participate in the development of 01D SOPs and documentation for DCAT authorization established in DoDI 8585.01.
• Research, review, prioritize, and submit operational requirements for acquisition of equipment or cyber capabilities through the 01D tool approval process.
• Support development and execution of TTPs for penetration testing and Red Teaming.
• Research adversary cyber actors’ TTPs, organizational structures, capabilities, personas, and environments, then integrate findings into cyber survivability test planning and execution.
• Participate in OPTEVFOR Cyber Test planning by conducting open-source research and reviewing systems under test documentation to identify attack surface and threat vectors across operational, lab, and cyber range environments, including physical, virtualized, and cloud-based systems.
• Participate in checkpoint meetings and help guide development of test plan objectives; review test plans to ensure objectives are feasible.
• Support test preparation activities, including site pre-test coordination visits and in-briefs to the test site.
• Lead red team test plan review and add relevant system technical information to the test reference library.
• Organize and lead research presentations for advanced capability development supporting future tests; prepare OPTEV-RT test assets (Government Furnished).
• Execute test events, including Cooperative Vulnerability Penetration Assessments, Adversarial assessments, and Cyber Tabletops, in support of Operational Testing, Developmental Testing, risk reduction events, or other assigned events.
• Use OPTEVFOR-provided and NAO-approved commercial and open-source network cyber assessment tools (e.g., Core Impact, Nmap, Burp, Metasploit, and Nessus).
• Apply ethical hacking expertise to exploit discovered vulnerabilities and misconfigurations across operating systems (Windows, Linux), protocols (HTTP, FTP), and network security services (PKI, HTTPS) to meet test objectives.
• Independently accomplish testing and provide direction to basic and intermediate operators.
• Ensure tests are conducted safely in accordance with the test plan and OPTEVFOR policies, and follow JFHQ-DODIN deconfliction procedures.
• Verify collected data for accuracy and completeness; participate in post-test iterative processes, including generation of deficiency/risk sheets, and document lessons learned.
• Participate in capture the flag events, cyber off sites, and external engagements such as red team huddles and red team technical exchange meetings, producing required materials.
• Attend OPTEVFOR required meetings supporting OT&E and generate/update documentation to maintain DCAT authorization compliance per DoDI 8585.0.

Requirements

• Minimum 6 years experience performing any combination of penetration testing, red teaming, or exploitation development.
• Minimum 6 years leading red team operators in penetration testing/red teaming to accomplish assigned test objectives.
• Required certifications: OSCP, OSCE, GX-PT, GXPM, PNPT, or HTB CPTS.
• Proficient with offensive tools including Metasploit, Cobalt Strike, Core Impact, Burp Suite, Nessus, and SharpHound/BloodHound.
• Ability to validate the functionality and safety of offensive tools (e.g., exploits) using source code and document results.
• Ability to detect malicious activity using dynamic analysis techniques and document results.
• Ability to independently operate to conduct penetration testing/red teaming to achieve assigned objectives.
• Proficient in Microsoft Office Suite, including Teams or similar workplace chat and videoconferencing tools.
• Excellent written and verbal communication skills.

Technologies

• Core Impact, Nmap, Burp, Metasploit, Nessus
• Cobalt Strike, Burp Suite, SharpHound/BloodHound
• Windows, Linux
• HTTP, FTP, PKI, HTTPS
• Microsoft Office Suite, Teams