Social Engineering & Security Awareness Testing Specialist

Security1stconsulting; Newport News (VA); On-site; USD 90,000 - 130,000; Full time

Job summary

Security1stconsulting seeks a Social Engineering & Security Awareness Testing Specialist to design and execute advanced social engineering programs for NNPS faculty and staff. You will create targeted phishing campaigns, perform vishing and pretexting, and coordinate in-person exercises with the Physical Penetration Tester.

You will translate observations into actionable security awareness recommendations for school leadership, ensuring compliance with Virginia code and maintaining tight test

Qualifications

• 3+ years designing and executing social engineering testing programs.
• Hands-on phishing simulation platform experience (Gophish, KnowBe4, Proofpoint or equivalent).
• Experience conducting vishing and pretexting campaigns.
• Strong analytical skills; translate campaign metrics into actionable findings.
• Clear written communication for technical and executive reporting.
• No felony convictions; certify compliance with Virginia Code §22.1-296.1.

Responsibilities

• Design and execute targeted phishing simulation campaigns tailored to NNPS staff roles using approved platforms.
• Conduct vishing and pretexting scenarios to test staff responses over the phone.
• Coordinate in-person social engineering exercises with the Physical Penetration Tester within the test plan scope.
• Establish a communications plan with NNPS to balance awareness and test validity.
• Track and analyze campaign results including click rates, credential submissions, and reporting rates by department and role.
• Document findings with business impact framing for school leadership.
• Recommend practical security awareness training improvements based on observed behavior.
• Certify compliance before any work at NNPS facilities during school hours.

Skills

Phishing simulations

Analytical reporting

Written communication

Social engineering testing

Tools

Gophish

KnowBe4

Proofpoint Security Awareness

Job description

Social Engineering & Security Awareness Testing Specialist

IT

Location

Work Mode

Employment Type

Experience Level

Security Clearance

Type: Active Secret

Status: Not needed

Job Description

The Social Engineering and Security Awareness Testing Specialist designs and executes a comprehensive social engineering testing program for NNPS faculty and staff. This goes beyond a basic phishing simulation - you will design targeted campaigns that reflect the actual threat landscape facing school districts, conduct vishing and pretexting scenarios, and coordinate in-person social engineering exercises. You then translate everything you observe into specific, actionable security awareness recommendations that school leadership can implement

Responsibilities

• Design and execute targeted phishing simulation campaigns tailored to NNPS staff roles, using approved platforms such as Gophish, KnowBe4, or equivalent.
• Conduct vishing (phone phishing) and pretexting scenarios to test staff responses to social engineering via telephone.
• Coordinate in-person social engineering exercises - including tailgating and impersonation - with the Physical Penetration Tester, within approved test plan scope.
• Establish a communication plan with NNPS that defines who is aware of testing and to what degree, preventing unnecessary alarm while maintaining test validity.
• Track and analyze campaign results including click rates, credential submission rates, and reporting rates by department and role.
• Document all findings with business impact framing that resonates with school administrators, not just IT staff.
• Recommend specific, practical security awareness training improvements based on observed behavior.
• Certify compliance with Virginia Code §22.1-296.1 before any work at NNPS facilities during school hours.

Requirements

REQUIRED QUALIFICATIONS

• 3 or more years of experience designing and executing social engineering testing programs.
• Hands-on experience with phishing simulation platforms — Gophish, KnowBe4, Proofpoint Security Awareness, or equivalent.
• Experience conducting vishing and pretexting campaigns.
• Strong analytical skills — ability to convert campaign metrics into meaningful, audience-appropriate findings.
• Clear written communication skills for both technical and executive-level reporting.
• No felony convictions; must be able to certify compliance with Virginia Code §22.1-296.1.

PREFERRED QUALIFICATIONS

• CEH or social engineering specialization (e.g., SECC — Social Engineering Certified Course).
• CISSP, Security+, or equivalent certification.
• Prior experience conducting security awareness testing in a K-12 or higher education environment.
• Experience coordinating physical social engineering scenarios alongside a physical pen test team.