Senior Penetration Tester

Cybersecurity Jobs; Washington (District of Columbia); Hybrid; USD 155,000 - 264,000; Full time

Benefits offered by this job

Health care

Life insurance

401(k)

Education assistance

PTO

Job summary

ASRC Federal Technology Solutions in Washington, DC is seeking a Senior Penetration Tester to lead advanced security assessments, drive testing strategy, and mentor a small team. This hybrid role requires hands-on testing of systems and applications and the development of assessment plans aligned with NIST SP 800-53 and FedRAMP controls.

The role involves coordinating with stakeholders to remediate findings, supporting secure operations, and guiding security engineering efforts across the

Qualifications

• Bachelor’s degree in a related field.
• 8+ years of relevant cybersecurity and penetration testing experience.
• Active DOE Q-Clearance or Top Secret (TS) equivalent required.

Responsibilities

• Lead and perform advanced security assessments, including hands-on penetration testing of systems and applications.
• Identify vulnerabilities, evaluate risk, and provide remediation recommendations.
• Develop and maintain assessment plans aligned with NIST SP 800-53 and FedRAMP Cloud Security Controls.
• Execute security assessments according to defined plans and document findings.
• Design, develop, and maintain tools and scripts to automate testing activities.
• Mentor a small team of junior penetration testers with technical guidance.
• Lead a Purple Team to support red/blue team exercises with customers.

Skills

Penetration testing

Team leadership

Assessment planning

Purple Team facilitation

Remediation guidance

Education

Bachelor’s degree in related field

Tools

NIST SP 800-53

FedRAMP Cloud Security Controls

Linux

Tenable Nessus

Forescout

Carbon Black

Invicti

Scythe

Rubrik

Fidelis

Job description

The Senior Penetration Tester role at ASRC Federal Technology Solutions focuses on leading advanced security assessments while supporting strategy, automation, and technical guidance across a penetration testing program. This hybrid position is based in Washington, DC.

Role Overview

In this position, you will conduct hands-on penetration testing of systems and applications and lead assessment planning and execution. The role also includes mentoring a small team of junior penetration testers, running Purple Team exercises with customer sites, and contributing to secure systems operations, validation, and accreditation work.

Location and Schedule

• Hybrid: Washington, DC (3 days per week onsite)

Compensation

• Salary: USD 155,355 - 264,133 per year

Key Responsibilities

• Lead and perform advanced security assessments, including hands-on penetration testing of systems and applications.
• Identify vulnerabilities, evaluate risk, and provide clear, actionable remediation recommendations.
• Develop and maintain assessment plans aligned with NIST SP 800-53 and FedRAMP Cloud Security Controls.
• Execute security assessments according to defined plans and document findings accurately and promptly.
• Design, develop, and maintain tools and scripts to automate and enhance penetration testing activities.
• Manage and mentor a small team of junior penetration testers, providing technical guidance and training.
• Build and lead a Purple Team to support joint red/blue team exercises with customer sites.
• Support secure systems operations and maintenance, including security validation and accreditation activities.
• Analyze and mitigate system security threats across the lifecycle, including risk assessments and implementation of security engineering controls.
• Support compliance needs related to business continuity, operations security, insider threat detection, physical security analysis, and regulatory requirements.
• Communicate technical results effectively to technical teams and executive stakeholders.

Required Qualifications

• Education: Bachelor’s degree in a related field.
• Experience: 8+ years of relevant experience in cybersecurity and penetration testing (or an equivalent combination of education and experience).
• Clearance: Active DOE Q-Clearance or Top Secret (TS) equivalent required.

Preferred Certifications

• OSCP (Offensive Security Certified Professional)
• OSCE (Offensive Security Certified Expert)
• CEH (Certified Ethical Hacker)
• CISSP (Certified Information Systems Security Professional)

Technologies and Tools

• NIST SP 800-53
• FedRAMP Cloud Security Controls
• Linux
• Tenable Nessus
• Forescout
• Carbon Black
• Invicti
• Scythe
• Rubrik
• Fidelis

Benefits

• Health care, dental, vision
• Life insurance
• 401(k)
• Education assistance
• PTO, holidays, and any other paid leave required by law