Lead Penetration Tester TS​/SCI Polygraph

Location: Annapolis Junction

** Description*
* ** Lead Penetration Tester*
* ** Leidos
* * has a new and exciting opportunity for a  
** Lead Penetration Tester
** in our  
** National Security Sector's (NSS) Cyber & Analytics Business Area (CABA)** . Our talented team is at the forefront in Security Engineering, Computer Network Operations (CNO), Mission Software, Analytical Methods and Modeling, Signals Intelligence (SIGINT), and Cryptographic Key Management. At  
** Leidos** , we offer  
** competitive benefits** , including Paid Time Off, 11 paid Holidays, 401K with a 6% company match and immediate vesting, Flexible Schedules, Discounted Stock Purchase Plans, Technical Upskilling, Education and Training Support, Parental Paid Leave, and much more.  
** Join us and make a difference in National Security!*
* ** Job Summary*
* Leidos is seeking a  
** Lead Penetration Tester
** to join a high performing agile team using the Scaled Agile Framework (SAFe) methodology on a large, complex program that provides system engineering, development, test, integration and operational support. The selected candidate will work on a team of cyber Subject Matter Experts (SMEs) who are providing support to a large, complex technical program for preventing, identifying, containing and eradicating cyber threats to networks through monitoring, intrusion detection, and protective security services on information systems including local area networks/wide area networks (LAN/WAN), commercial Internet connections, public facing websites, security devices, servers and workstations.

She/he will be responsible for the overall security of Enterprise-wide information systems, and will collect, investigate, and report any suspected and confirmed security violations.

** Primary Responsibilities*
* + Perform internal and external pentests against systems to determine vulnerabilities and develop mitigation strategies.

+ Perform web app pentests.

+ Perform vulnerability risk assessments.

+ Perform physical pentests and social engineering analysis.

+ Perform cyber incident response as needed.

+ Evaluate the impact of new development on the operational security posture of IT systems.

+ Evaluate, review, and test critical software.

+ Formulate security compliance requirements for new system features.

+ Identify and remediate security issues throughout the system.

+ Audit and assess system security configuration settings using common methodologies and tools.

+ Work with development teams to enrich team-wide understanding of different types of vulnerabilities, attack vectors, and remediation approaches.

+ Work closely with System Engineering, Test Engineering, and Integration teams to ensure hardware and software architecture and implementations meet strict security requirements.

+ Propose, assess, coordinate, implement, and enforce information systems security policies, standards, and methodologies.

+ Serve as a Subject Matter Expert in security architecture, to include providing advice to Program Managers, Customer technical experts, and internal program teams.

** Basic Qualifications*
* + Bachelor's degree in a technical/information assurance field and at least 12 years of prior relevant experience. Additional years of experience and/or cyber certifications may be considered in lieu of a degree.

+ Must have experience with penetration testing tools.

+ Must have experience in web development and programming languages such as Java, XML, Perl and HTML.

+ Must have experience with programming/scripting in Python, Powershell, C, JavaScript, etc.

+ Must have extensive experience performing IT security risk assessments.

+ Must have experience performing web app and physical pentests.

+ Must have experience with or strong familiarity of the following Web Application tools;
Burp Suite, Web Inspect, App detective.

+ Must have experience with or strong familiarity of Kali.

+ Must have experience with or strong familiarity of IPS/IDS solutions.

+ Must have a strong understanding of the Cyber Kill Chain methodology.

+ Must have experience applying Risk Management Framework.

+ Must have experience with secure configurations of commonly used desktop and server operating systems.

+ Must have the ability to…