Cyber Security Engineer - Penetration Tester (Journeyman)

Location: Hybrid Alexandria, VA

Clearance: Top Secret

Adversary Simulation: Deploy, configure, and operate Command and Control (C2) frameworks such as Cobalt Strike, Havoc, Mythic, and Sliver. Apply tactics, techniques, and procedures (TTPs) for initial access, lateral movement, privilege escalation, persistence, and data exfiltration. Leverage proprietary and open-source offensive security tool sets effectively to achieve engagement objectives. Execute phishing assessments.

Infrastructure: Monitor, manage, and maintain cloud and on-premise infrastructure used during assessments. Use Git repositories to maintain operational tools and scripts.

Penetration Testing: Conduct internal and external penetration testing. Perform network mapping and enumeration. Assess web and mobile applications. Perform database scans. Assess Active Directory attack paths using tools such as BloodHound.

Security Assessments: Assess the cyber security posture of Coast Guard operational networks through adversary emulation. Develop reports and briefs detailing findings and recommendations for all completed assessments. Perform cyber threat emulation during scripted exercises to train DoD Cyber Protection Teams. Required Qualifications2 to 3 years of relevant experience. Active Top Secret security clearance with SCI eligibility. Hands-on experience with computers and network security. Experience conducting phishing campaigns or social engineering. Hands-on experience with red team tasks and penetration testing. Familiarity with malware development and EDR/AV bypass strategies. Experience with PowerShell, C, C++, or Python. Hands-on experience using C2 frameworks such as Cobalt Strike, Sliver, Havoc, or similar.

Preferred Qualifications: Experience supporting Red Team or offensive cybersecurity operations. Experience with web application, network, wireless, cloud, or infrastructure penetration testing. Familiarity with tools such as Nmap, Burp Suite, Metasploit, BloodHound, Wireshark, or similar security testing tools. Knowledge of common attack frameworks and methodologies, including MITRE ATT&CK.Experience developing penetration testing reports and presenting technical findings. Active industry-recognized cybersecurity certifications such as OSCP, CEH, PenTest+, GPEN, or comparable certifications.