Cyber Penetration Tester – Networks
Are you looking for a challenge? Are you comfortable primarily operating on the UNIX/Linux command line; approach tasks in a methodical manner with an ability to analyze and deduce problem areas in a network? Are you looking for a position where you can apply your current cyber security skills while providing you an avenue to advance your knowledge and grow into the role of a penetration tester– responsible for conducting penetration testing, reverse engineering and development of code/scripts to leverage attack vectors? If so, this position may be perfect for you. Initial roles and responsibilities require the candidate to conduct vulnerability and compliance assessments on Windows and UNIX/Linux hosts with the intent to grow the right candidate into accomplishing penetration testing, reverse engineering and development of script/code to leverage identified attack vectors or zero days. Short term, the candidate would be responsible for identifying vulnerabilities, analyzing results, manually verifying findings to eliminate false positives or negatives, and capturing artifacts such as screen captures, etc., to provide evidence and artifacts for each exploitable vulnerability. Long term, the right candidate migrate to a penetration test role where they'd be responsible for conducting a holistic evaluation of a system or application; analyzing, evaluating and identifying vulnerabilities and zero days and developing exploits to take advantage of these identified security flaws.
More specifically, the candidate will:
- Be strong in and intimately familiar with operating from the UNIX/Linux command line.
- Be able to successfully execute network mapping to identify live hosts and active ports, protocols and services (PPS) and analyze the results of NMAP data to identify risky PPS.
- Conduct vulnerability and compliance assessments on AF/DoD systems for Cyber Vulnerability Assessments (CVA); upon demonstrated ability and customer acceptance, conduct penetration test activities; familiarity with Wireshark/TCP Dump and common network vulnerability and compliance scanners such as Nessus, Nexpose, SCAP Compliance Checker, etc., beneficial.
- Exhibit an ability to methodically analyze problems, identify solutions and remain composed in potentially stressful situations.
- Adequately explain, present, demonstrate [when applicable] and document the operational impact of a particular vulnerability.
- Assist customer with implementing policies and tactics, techniques and procedures for conducting assessments.
- Exhibit good writing and communications skills, to include the ability to render concise reports, summaries and formal oral presentations.
- Understand and be proficient in common cyber threat terminology, methodologies, possess basic understanding of cyber incident and response, and related current events.
- Travel up to 25% supporting assessments up to 1-4 weeks in duration.
- Must have an active TS/SCI clearance.
- Must possess or be willing to obtain a DoD 8570 IAT Level 3 (CISSP, CASP, etc.) certification and a penetration test certification (i.e., GPEN, GXPN, GWAPT) within 6 months.
- Possess or be willing to obtain a MCP and Linux certification within a defined timeframe.
- Minimum Bachelor’s degree and 2 years’ experience; Associates degree with 4 years’ experience or 6 years equivalent experience without a degree; degrees focused on engineering or applied science.
- Penetration Test Certification (eJPT, GPEN, GXPN, GWAPT, Etc.) and hands on experience with penetration testing and reverse engineering, The Metasploit Framework, Burp Suite, or similar architecture(s)/application(s) (5 years).
- Experience in working with and in a network systems security environment with a focus on security and information assurance (5 years).
- Must have thorough knowledge of common network ports and protocols.
- Strong knowledge of Windows® Internals, Windows® Application Programming Interfaces (API), Portable Executable (PE) formats, Windows® Registry, and security models.
- Experience with Bash and Power Shell.
- Experience in one of the following scripting languages: Perl, Python or Ruby is required.
- Strong knowledge of the following programming languages: Assembly, Java, C#, C, C++ and SQL.
- Work experience with developing proof-of- concept exploit examples to use within reports or live demonstrations.
- Must complete self-assessment questionnaire, customer pre-screen, skills assessment lab, pass the customer’s training and certification program and remain mission ready qualified.
- Candidate should be self-motivated with minimal supervision.
- Analyze, disassemble, and reverse engineer code/executables to discern weaknesses for exploitation; document and transition results in reports, presentations and technical exchanges.
- Cyber security experience relating to identifying zero day exploits, attack vectors, etc.
- Experience or familiarity with military operations and common protocol is highly desirable.