Penetration Tester

Koniag Government Services seeks a Penetration Tester to support authorized cybersecurity assessment initiatives for KOS and a government customer in Washington, DC (hybrid).

• Conduct authorized penetration testing on networks
  , web applications
  , mobile applications
  , and infrastructure to uncover security weaknesses.
• Perform vulnerability assessments and attempt exploitation of identified vulnerabilities in a controlled, authorized manner.
• Develop and execute test plans covering reconnaissance
  , scanning
  , exploitation
  , and post-exploitation activities.
• Use industry-standard tools and techniques, including Metasploit
  , Burp Suite
  , and Nmap (as well as Nessus
  ) to evaluate system security.
• Write custom scripts and tools to automate testing and support exploit development when needed.
• Produce detailed technical reports with risk ratings
  , exploitation methods
  , and remediation recommendations
  .
• Communicate findings and recommendations to technical teams and leadership in an actionable format.
• Collaborate with system administrators, developers, and security teams to validate and remediate vulnerabilities.
• Support social engineering assessments
  , including phishing campaigns
  , when required.
• Maintain awareness of emerging threats, attack vectors, and current penetration testing methodologies.
• Participate in red team /
  blue team exercises and support purple team collaboration efforts.
• Ensure all testing activities follow rules of engagement
  , legal requirements, and organizational policies.
• Support continuous monitoring and enterprise-wide security assessment activities.

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or related field from an accredited institution; equivalent experience may be considered in lieu of a degree.
• 3-5 years of experience in penetration testing, ethical hacking, or offensive security roles.
• Demonstrated experience conducting network
  , web application
  , and/or wireless penetration tests.
• Experience using scripting languages such as Python
  , Bash
  , or Power Shell for tool development and automation.
• Exceptional communication skills (written and oral) to translate complex technical findings into actionable recommendations for technical and non-technical stakeholders.
• Strong understanding of networking protocols
  , Windows and Linux operating systems, and system architectures.
• Hands‑on experience with penetration testing tools, including Metasploit
  , Burp Suite
  , Nmap
  , Wireshark
  , and Kali Linux
  .
• Knowledge of vulnerability frameworks:
  OWASP Top 10
  , MITRE ATT&CK
  , and CVSS scoring
  .
• Experience performing both internal and external penetration tests.
• Ability to think creatively and use an attacker mindset to identify non‑obvious weaknesses.
• Strong grasp of security concepts, including encryption
  , authentication
  , and access control mechanisms.
• Ability to work independently and manage multiple engagements under tight deadlines.
• Strong report writing skills with attention to detail and accuracy.
• Ability to obtain and maintain a Public Trust Clearance.

• Metasploit
• Burp Suite
• Nmap
• Nessus
• Python
• Bash
• Power Shell
• Wireshark
• Kali Linux
• OWASP Top 10
• MITRE ATT&CK
• CVSS
• Windows
• Linux
• AWS
• Azure
• GCP
• SAST
• DAST
• NIST 800-53
• FedRAMP
• RMF
• Kubernetes

• Medical, dental, and vision insurance
• 401(k) retirement plan
• Paid time off
• Paid parental leave
• Life and disability insurance
• Flexible spending accounts
• Commuter benefits
• Tuition reimbursement

• Experience supporting federal government IT environments for security assessments.
• Industry certifications such as OSCP, GPEN, CEH, or CISSP.
• Experience with cloud security assessments (AWS, Azure, GCP).
• Familiarity with red team operations and adversary emulation techniques.
• Knowledge of secure coding practices and application security testing (SAST/DAST).
• Experience with container and Kubernetes security testing.
• Familiarity with compliance frameworks such as NIST 800-53, FedRAMP, or RMF.

Location: Washington, DC (hybrid).
Salary: USD 140, per year.