Penetration Tester

Looking for an opportunity to make an impact? At Leidos, we deliver innovative solutions through the efforts of our diverse and talented people who are dedicated to our customers’ success. We empower our teams, contribute to our communities, and operate sustainable. Everything we do is built on a commitment to do the right thing for our customers, our people, and our community.

Our Mission, Vision, and Values guide the way we do business. If this sounds like a mission you want to be a part of, keep reading!

Leidos is seeking experienced Penetration Testers to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. Leidos is a major partner on the contract and will provide a substantial portion of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC. The Penetration Tester will conduct Government-directed penetration testing and threat-hunting assessments across DHRA systems, networks, applications, and supporting technologies.

This position will identify exploitable weaknesses, validate the effectiveness of defensive cybersecurity capabilities, and provide actionable findings that help system owners and cybersecurity teams reduce risk.

Work Location:

Mark Center, Alexandria, Virginia Mission EnvironmentDMDC supports the Defense Human Resources Activity within the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD(P&R)) and maintains the Department of Defense’s largest and most comprehensive central repository of personnel, manpower, casualty, pay, entitlement, personnel security, identity, readiness, training, and related data.

The DHRA Information Technology (IT) environment includes approximately 15,000 network and endpoint devices supporting more than 600 Government-Off-The-Shelf (GOTS) applications and approximately 100 Risk Management Framework (RMF) authorization boundaries managed through the Enterprise Mission Assurance Support Service (eMASS).The penetration-testing team conducts Government-selected assessments of DHRA programs and also performs ad hoc testing with cybersecurity-tool administrators and Security Operations Center personnel to determine whether defensive capabilities are detecting and alerting as intended.

Testing may span enterprise networks, web applications, applications, code, and other mission systems.

Primary Responsibilities Conduct Government-selected penetration-testing assessments and threat-hunting activities in accordance with established DMDC procedures and the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115.Develop assessment plans, methodologies, test objectives, rules of engagement, and technical approaches appropriate to the target environment.

Execute authorized penetration-testing activities against networks, systems, applications, web applications, and code.

Identify vulnerabilities, exploitable configurations, attack paths, and weaknesses that could be used by a malicious actor.

Assess the practical exploitability and potential mission impact of identified security weaknesses.

Research emerging and existing threats, attack techniques, vulnerabilities, and adversary behaviors that may affect DHRA systems.

Develop testing methodologies designed to identify areas of risk likely to be targeted by an intruder.

Conduct threat-hunting activities to identify suspicious or malicious activity that may not be detected through routine monitoring.

Perform cooperative testing with cybersecurity-tool administrators, Security Operations Center (SOC) analysts, incident-response personnel, and Security Information and Event Management (SIEM) content developers.

Validate whether enterprise cybersecurity tools properly detect, generate alerts for, and support analysis of authorized offensive activity.

Identify detection or alerting gaps discovered during testing and provide technical findings to the appropriate cybersecurity teams.

Support pre-audit penetration testing to identify exploitable weaknesses before formal assessments or reviews.

Apply established penetration-testing methodologies and approved commercial or open-source offensive-security tools.

Support Red Team and Blue Team activities designed to evaluate and improve enterprise cybersecurity defenses.

Document testing activities, technical evidence, vulnerabilities, exploitation results, and risk findings.

Develop post-assessment out-briefs and final assessment reports for Government stakeholders.

Provide technically actionable…