Who you'll be:

We are seeking a skilled Penetration Tester to support our Agency's information systems, ensuring comprehensive security controls assessments, compliance with FISMA requirements, and continuous monitoring. This role involves conducting specialized assessments, including wireless, RF, mobile applications, and High Value Asset (HVA) evaluations, and supporting adversarial assessments to emulate real-world cyber threats.

What you'll do:

• Perform penetration testing at the request of Components/System Owners/ISSM/ISSO, including preparing and submitting Rules of Engagement (ROE) for Government approval.
• Deliver detailed findings and recommendations reports to relevant stakeholders and support remediation and retesting efforts.
• Conduct wireless access point and RF assessments across the Agency's sites, including Puerto Rico and Guam, while managing a master travel/assessment schedule.
• Perform mobile application assessments and Non-Tier 1 HVA assessments, generating reports in CISA-prescribed formats.
• Support Adversarial Assessments through initial engagement meetings, Cyber Table-Top (CTT) scenario execution, and Cooperative Vulnerability Penetration Assessments (CVPA).
• Collaborate with SOC/CTI/CDF teams to conduct assessments and emulate Indicators of Compromise (IOCs), Tactics, Techniques, and Procedures (TTPs), and Common Weakness Enumerations (CWEs).
• Travel as needed, both CONUS and OCONUS, to perform onsite security assessments of facilities, systems, and applications.
• Maintain a repository and metrics tracking of past penetration tests and support annual ISSO training on VAT services and capabilities.

What you'll need:

• 3 years of professional experience in penetration testing and offensive security assessments; or, with a bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field, 5 years of such experience.
• Hands-on experience with penetration testing methodologies, wireless/RF assessment tools, mobile application security testing, and CISA HVA assessment procedures.
• Preferred certifications include OSCP (Offensive Security Certified Professional), GPEN (GIAC Penetration Tester), and CEH (Certified Ethical Hacker).