Penetration Tester ​/ Red Team Operator

Penetration Tester / Red Team Operator

Location:

Bethesda, MD (Hybrid; On-site as Required)

Clearance:
Tier 2 Public Trust (Required)

Employment Type:

Full-Time

Digital Global Connectors (DGC) is seeking an experienced Penetration Tester / Red Team Operator to support a Federal information security program. The Penetration Tester is responsible for performing authorized security assessments that evaluate the effectiveness of technical, administrative, and operational security controls protecting enterprise information systems, cloud environments, applications, wireless networks, and supporting infrastructure.

This position conducts penetration tests, adversary emulation exercises, vulnerability exploitation, security validation, and red team assessments to identify weaknesses before they can be exploited by malicious actors. The Penetration Tester collaborates with Security Engineers, Security Architects, Threat Hunters, Incident Responders, ISSOs, System Owners, and program leadership to strengthen enterprise cybersecurity through proactive security testing and risk-based recommendations.

The successful candidate will possess extensive experience performing enterprise penetration testing, application security testing, network exploitation, and adversary simulation within complex enterprise environments.

Penetration Testing

• Conduct authorized internal and external penetration tests against enterprise systems.
• Perform network, application, wireless, cloud, and infrastructure security assessments.
• Validate vulnerabilities identified during automated vulnerability scans.
• Identify exploitable weaknesses in enterprise environments.
• Document attack paths and associated business risks.
• Recommend remediation strategies to eliminate identified vulnerabilities.

• Conduct adversary emulation exercises based on real-world threat actor tactics.
• Simulate advanced persistent threat (APT) activities.
• Evaluate the effectiveness of enterprise detection and response capabilities.
• Test security monitoring, alerting, and incident response processes.
• Coordinate red team activities with authorized stakeholders.
• Support purple team engagements to improve defensive capabilities.

• Perform manual and automated web application security assessments.
• Test for vulnerabilities consistent with the OWASP Top 10 and API Security Top 10.
• Evaluate authentication, authorization, session management, and input validation.
• Assess application programming interfaces (APIs) for security weaknesses.
• Validate remediation of application vulnerabilities.
• Document technical findings and business impacts.

• Assess internal and external network security.
• Evaluate firewalls, routers, switches, VPNs, wireless networks, and remote access solutions.
• Test network segmentation and access controls.
• Assess Active Directory security.
• Evaluate identity and privilege escalation paths.
• Validate network hardening measures.

• Perform security assessments of Microsoft Azure, Microsoft 365, Amazon Web Services (AWS), and hybrid cloud environments.
• Evaluate cloud identity configurations and privileged access.
• Test cloud networking and storage configurations.
• Assess cloud-native security controls.
• Identify cloud misconfigurations and excessive permissions.
• Recommend improvements to cloud security architecture.

Utilize technologies including:

• Kali Linux
• Metasploit Framework
• Burp Suite Professional
• Nmap
• Nessus
• Tenable Security Center
• Blood Hound
• Cobalt Strike (where authorized)
• Impacket
• Wireshark
• OWASP ZAP
• Microsoft Defender XDR
• Microsoft Sentinel
• Power Shell
• Python
• Security Information and Event Management (SIEM) platforms

Evaluate new tools and techniques to improve testing effectiveness.

Develop and maintain:

• Penetration Test Reports
• Executive Summary Reports
• Technical Findings Reports
• Risk Assessments
• Remediation Recommendations
• Red Team After-Action Reports
• Attack Path Diagrams
• Proof-of-Concept Documentation
• Standard Operating Procedures
• Lessons Learned

Ensure reports clearly communicate technical findings, business impacts, and recommended corrective actions.

• Coordinate with Security Engineers, Security Architects, ISSOs, SOC Analysts, Threat Hunters, Incident Responders, System Owners, and Government stakeholders.
• Support remediation planning and validation efforts.
• Participate in security assessments and technical working groups.
• Provide technical briefings to technical and executive leadership.
• Mentor junior penetration testers when appropriate.

• Monitor emerging attack techniques, exploit methodologies, and threat actor tactics.
• Evaluate new penetration testing tools and methodologies.
• Recommend improvements to enterprise security testing capabilities.
• Support purple team exercises and continuous security validation initiatives.
• Maintain professional certifications and technical expertise.