Senior Penetration Tester - Federal Programs

NikSoft Systems Corp; United States; On-site; USD 110,000 - 180,000; Full time

Job summary

NikSoft Systems Corporation in Reston, Virginia, is seeking a Penetration Tester to join our federal cyber security team. The role focuses on testing security controls across agency IT systems and networks, using automated tools and manual techniques.

You will perform in‑depth testing of web, client/server apps, APIs, and network devices, document findings, and present risk‑based recommendations to stakeholders.

Qualifications

• Bachelor's degree in Computer Science or a related IT field.
• 7+ years of relevant experience in software development, cyber security, and testing.
• Highly skilled in web application testing, API testing, and network testing.
• Prior experience with Burp Suite Professional, or other similar DAST tools.
• Experience with AI and penetration testing AI.
• Experience with Kali Linux and most of the tools available in the distro for penetration testing.
• Experience with tools such as Metasploit Pro and Cobalt Strike for red team operations.
• Experience with Red Team engagements from planning to execution.
• Experience with phishing network users to gain access for lateral movement on the network.
• Experience with Purple Team engagements to test monitoring controls in coordination with engineering teams and CSOC teams.
• Proficiency in scripting, such as Python and/or PowerShell.
• Experience with penetration testing supporting PCI-DSS.
• Technical writing skills, along with ease in communicating concepts related to security vulnerabilities and attack path scenarios.
• Familiar with OWASP Application Security Verification Standard (ASVS) and MITRE ATT&CK framework
• Penetration testing certification recommended. Acceptable certifications: Offensive Security Certified Professional (OCSP), Global Information Assurance Certification (GIAC) Certifications (e.g., GIAC Certified Penetration Tester (GPEN), GIAC Web Application Penetration Tester (GWAPT), or GIAC Exploit Researcher and Advanced Penetration Tester (GXPN))

Responsibilities

• The successful candidate will use both automated tools and manual techniques to test the security controls deployed at various points within Agency's information systems and networks.
• Penetration tester will be required to perform testing, document results, engage with stakeholders, conduct meetings, discuss findings, provide recommendations, explain testing techniques, and stay current on weaknesses and vulnerabilities which are announced both publicly and privately.
• The Penetration tester will perform in-depth testing, which may include exploitation of Agency's assets in order to determine the resiliency and permeability of Agency's networks and IT systems.
• Perform security testing of web applications, client/server applications, web services, APIs, operating systems, databases, and network fabric devices (i.e. switches, routers, firewalls, load balancers, WAPs, etc.).
• Provide technical security assessments of applications and infrastructure, security design reviews as well as risk assessments.
• Ensure current penetration testing tools are sufficient to the task of conducting penetration testing for Agency and regularly look for and recommend additional software that which may fill gaps in Agency's current security testing toolset.

Skills

Web app testing

API testing

Network testing

Python

PowerShell

Phishing simulations

Red Team concepts

Scripting

Security writing

Education

Bachelor's degree in Computer Science or related IT field

Tools

Burp Suite Pro

Kali Linux

Metasploit Pro

Cobalt Strike

Job description

NikSoft Systems Corporation in Reston, Virginia, is seeking a Penetration Tester to join our federal cyber security team. The role focuses on testing security controls across agency IT systems and networks, using automated tools and manual techniques.

You will perform in‑depth testing of web, client/server apps, APIs, and network devices, document findings, and present risk‑based recommendations to stakeholders.