Penetration Tester

Purple Jay is a veteran-owned IT and Info Sec company that guides government agencies and private organizations into the right balance of business productivity and implements security measures to help maximize their outcomes and achieve their mission. We believe that effective cybersecurity solutions must go beyond simply protecting data and systems – they must align with the mission to enable and empower progress.

Our teams are built to provide cross-domain services with highly skilled and trained personnel supported by cross-matrix, agile teams and our proprietary digital solutions that have a track record of success. Our positively charged approach intends to exceed client’s minimum requirements, reduce client and organizational risk, and maximize the return on investment.

• Have a curious and intellectual mind who are inclined to ask “why”.
• Use creative thinking and adaptive decision-making to solve problems.
• Value their contribution and the contribution of others on the team.
• Are passionate about learning and developing skills to overcome challenges.
• Look to leverage their knowledge or experience to advance within the Info Sec Industry.
• Can connect with people of diverse backgrounds and communication styles, through empathy and clear verbal, visual, and written communication.

Our Threat Resilience team answers specific security questions for federal programs with hands-on evidence, inside a fixed window
. When a system’s risk can’t be settled by documentation and vendor attestation alone, we test it directly from an attacker’s point of view. We then put what we find in the context of real threats and give the decision maker a defensible answer with practical fixes. Engagements range from a bounded technical check, to a focused assessment across several components, to a deep evaluation spanning multiple trust boundaries.

As a mid-level Penetration Tester, you’ll be a core operator on these engagements. You’ll test under a senior engagement lead and build the proof-of-concept tooling that confirms or rules out an attack path. Then you’ll turn your findings into evidence and recommendations that a government Authorizing Official can act on
.

• This position is based in Ashburn, VA, and requires travel for on-site assessments at customer facilities.
• Applicants must hold the Offensive Security Certified Professional (OSCP) certification or have 3 to 5 years of hands-on professional penetration testing experience.
• Applicants must be able to obtain and maintain a federal background investigation (Public Trust or higher).
• Applicants must be a US Citizen.

Purple Jay teams are cross-functional and cross-matrixed to aid in the effective delivery of services and digital solutions. The role responsibilities include but are not limited to:

Plan and execute hands-on security assessments, including:

• Internal and external network penetration tests, including Active Directory enumeration and attack-path analysis, privilege escalation, credential attacks, and lateral movement
• Web application and API testing for flaws in authentication, authorization, session management, and business logic
• Adversary emulation using realistic tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK, with commercial and open-source offensive tooling
• Assessments of cloud and SaaS environments, wireless and RF systems, and specialized environments such as industrial control systems, robotic automation, and medical devices, using safe, non-disruptive methods suited to production conditions
• Physical security assessments and authorized social engineering engagements when they are in scope

Hunt, detect, and validate:

• threats in endpoint, network, and log telemetry, starting from a hypothesis, to find…