Senior Software Assurance and Vulnerability Engineer

Tharros; Washington (District of Columbia); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Training reimbursement (up to $5,250/€

Competitive compensation

Medical, dental, vision, disability

SAV retirement & paid leave

Job summary

Tharros in Washington DC seeks a Senior Software Assurance and Vulnerability Engineer to support a DHS Intelligence and Analysis cybersecurity program in the National Capital Region. The role covers penetration testing, software assurance, vulnerability assessment, and cyber supply chain risk management across secure cloud and hybrid environments.

You will identify systemic weaknesses, validate exploitability, and deliver remediation recommendations with strong written and verbal communication,

Qualifications

• Strong written and verbal communication skills required.
• Active Top Secret clearance with SCI eligibility preferred.
• 10+ years in cybersecurity assessment, penetration testing, or vulnerability assessment.
• 2+ years in areas: software assurance, penetration testing with automated tools, vulnerability assessment, secure cloud and cross-domain testing.

Responsibilities

• Conduct penetration testing, vulnerability assessments, and software assurance for Federal mission systems.
• Perform testing using MITRE ATT&CK, OWASP, and NIST 800-115.
• Support pre-engagement planning, rules of engagement, and reporting.
• Translate findings into remediation plans, risk insights, and POA&Ms.
• Maintain testing kits, tooling, and procedures; contribute to secure cloud and DevSecOps efforts.

Skills

Strong written and verbal commu­n ica

Onsite work ability

Leadership

Education

CEH

CISSP

Tools

MITRE ATT&CK

OWASP

NIST 800-115

Archer

eMASS

Xacta

Job description

Tharros is looking for courageous team members that enable government missions to move forward with confidence.

Who We Are

At Tharros, expertise, confidence and continuous advancement are at the foundation of what we do. With us, you work with the world’s preeminent vulnerability experts to not only advance government missions, but also your own career path. We’re looking for confident leaders to grow and evolve as we do, protecting our nation’s protectors with cutting-edge cybersecurity tools.

Seeing everything includes seeing everyone. Tharros moves missions forward with a courageous team of experts and a variety of perspectives.

Outperform

Lead with Growth

Dare to Secure

At Tharros, we have exceptional benefits because our employees’ success is our success. We support our team members’ growth with training opportunities, tools and resources.

Outperform the Expected

Tharros sets high standards because we know our team can meet and exceed them. We anticipate success, expect exceptional results and ensure impact for everyone.

Lead with Continuous Growth

When our employees grow, everyone thrives. As the leaders in vulnerability research, we grow capability for our clients and our employees.

Dare to Secure Anything

At the cutting-edge of cybersecurity technology, Tharros dares to create tools that will have maximum mission impact. Our company culture reflects this confidence.

Benefits of Working with Tharros

Moving boldly forward requires a strong foundation. Tharros provides foundational benefits that help our employees grow and thrive.

To be the best, you join the best. Tharros offers competitive compensation and comprehensive benefits including medical, dental, vision and disability coverage, savings & retirement and paid leave.

At Tharros, leaders develop leaders. Working at Tharros gives our employees access to resources and expertise found nowhere else, and we nurture the future leaders in cybersecurity from within our ranks.

We’re not afraid to show our commitment to growing our Tharros team. We offer generous referral bonuses to employees who help us reach hiring goals.

Training & Certification Reimbursement

Tharros is always advancing. We offer an education reimbursement benefit of up to $5,250 per year to help our employees thrive.

Breaking Barriers to Cybersecurity Success

Our people-first culture enables more flexibility for our employees to find success in cyber fields. At Tharros, there are no barriers between you, the world’s leading cybersecurity experts, and our customers.

Senior Software Assurance and Vulnerability Engineer

Tharros is seeking a Senior Software Assurance and Vulnerability Assessment Engineer to support a DHS Intelligence and Analysis cybersecurity program in the National Capital Region. This role will support advanced penetration testing, software assurance, vulnerability assessment, cyber supply chain risk management, secure cloud and hybrid engineering, and cross-domain security assessment activities. The ideal candidate is a senior technical assessor who can go beyond automated scanning to identify systemic weaknesses, validate exploitability, assess operational impact, and provide clear remediation recommendations for complex mission environments.

Responsibilities:

• Conduct penetration testing, vulnerability assessments, software assurance, and cyber supply chain risk management activities for Federal mission systems.
• Perform full-scope security testing using established methodologies such as MITRE ATT&CK, OWASP, NIST 800-115, and related Federal or IC assessment practices.
• Support pre-engagement planning, rules of engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting.
• Use approved automated and manual testing methods to identify vulnerabilities, validate exploitability, and assess potential business and operational impacts.
• Identify vulnerabilities commonly missed by automated tools through manual, expert-driven testing techniques.
• Assess SOC detection and response capabilities through controlled testing activities.
• Produce penetration testing reports, vulnerability assessment reports, software assurance recommendations, and corrective action guidance.
• Support software assurance through vulnerability and compliance testing, source code review, static/dynamic analysis, dependency review, and software supply chain risk identification.
• Conduct vulnerability assessments and interpret results to recommend corrective actions and mitigation strategies.
• Support secure cloud, hybrid, DevSecOps, application, identity, API, microservices, CI/CD, Zero Trust, and cross-domain assessment activities.
• Maintain secure testing kits and assessment tooling, including patching, configuration updates, and approved tool management.
• Update and maintain penetration testing, SCRM, and vulnerability assessment procedures.
• Support audits, working groups, and stakeholder briefings related to penetration testing, software assurance, vulnerability assessment, and cyber supply chain risk.
• Identify opportunities to improve testing processes, automate assessment workflows, strengthen reporting, and produce useful metrics for leadership and technical stakeholders.
• Translate assessment findings into actionable remediation plans, risk insights, POA&M inputs, dashboards, and decision-ready reporting.

Requirements:

• Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
• 10+ years of related cybersecurity assessment, penetration testing, software assurance, vulnerability assessment, or cyber supply chain risk experience.
• 2+ years of recent experience in each of the following areas: software assurance, penetration testing with automated tools, vulnerability assessment, security patch management, secure cloud and hybrid engineering, and
• Cross Domain Solutions.
• CEH and CISSP certifications, or comparable demonstrable experience.
• Experience conducting penetration testing, vulnerability assessments, software assurance, source code review, SCRM, and cyber supply chain management activities.
• Experience using both automated tools and manual testing processes to identify, validate, and document vulnerabilities.
• Experience producing technical reports, corrective action recommendations, mitigation strategies, and executive‑ready summaries.
• Strong understanding of vulnerability management, exploitability, secure configuration, remediation validation, and operational risk.
• Strong written and verbal communication skills.
• Ability to work onsite​as​a​government‑approved​location​as​required.

Preferred Qualifications:

• Prior DHS, Intelligence Community, DoD, CISA, classified red team, software assurance, SCRM, CVPA, vulnerability research, or national security cyber assessment experience.
• Experience with MITRE ATT&CK, OWASP, NIST 800-115, IC “Raise the Bar,” NIST SP 800‑161, CNSSI 1253, DHS 4300C, or related Federal/IC cybersecurity frameworks.
• Experience testing cloud, application, identity, API, microservices, CI/CD, DevSecOps, Zero Trust, cross‑domain, and hybrid TS/SCI environments.
• Experience with SBOM analysis, static/dynamic code analysis, dependency review, source code review, exploit validation, secure configuration, and remediation validation.
• Experience with GRC platforms such as Archer, eMASS, or Xacta, including the ability to translate findings into POA&Ms, dashboards, scorecards, and remediation workflows.

Equal Opportunity Employment

Tharros is committed to implementing employment programs and policies dedicated to equal employment opportunity and nondiscrimination. Learn more today.

Be Bold with Tharros

Want to learn more about what it means to work with the world’s preeminent cyber vulnerability experts? Contact us to learn more about who we are and how you can join us.