Remote Penetration Testing Specialist

Summary

Join Agile Defense as a Penetration Testing SME and contribute to enhancing existing Pen Test resources for the USPTO, Cybersecurity Division.

Requirements

• PNPT, OSCP, OSCE, GXPN, GPEN, GCIH, GWAPT, GCFA or possess a willingness to pursue certifications after hire
• Bachelor’s degree/University degree or equivalent experience
• 5+ years of relevant experience with the requirements below
• Extensive experience working with Offensive Security Methodologies and Attack Simulation Techniques
• Offensive Security testing tools. e.g., Cobalt Strike, Kali Linux, Bloodhound, Red Team Toolkits
• Exploitation frameworks, e.g., Metasploit, CANVAS, Core Impact
• Deep understanding of OSI model
• OS Security. e.g. Unix/Linux, Windows, OSX
• Understanding of common protocols. e.g. HTTP, LDAP, SMTP, DNS
• Web application infrastructure. e.g. Application Servers, Web Servers, Databases
• Demonstrated ability to collaborate with a variety of analytical groups and service delivery organizations
• Advanced analytical and problem-solving skills
• Consistently demonstrates clear and concise written and verbal communication
• Proficient in interpreting and applying policies, standards and procedures
• Demonstrated ability to remain unbiased in a diverse working environment

Responsibilities

• Conduct Penetration Testing (application and/or infrastructure) and articulate security issues to both technical and non-technical audiences
• Identify, research, validate, and exploit various known and unknown security vulnerabilities
• Coordinate with business and technical contacts to assist in the development and delivery of secure solutions
• Compose detailed, technical, attack narratives which outline specific attack chains utilized, clear impact of vulnerabilities discovered, and suggested paths to remediation which address root cause of identified weak points in enterprise security architecture

Preferred Qualifications

• Experience leveraging the MITRE ATT&CK Framework
• Vulnerability Assessment tools. e.g., Nessus, Qualys, Rapid7
• Social Engineering campaigns. e.g. email phishing, phone calls, SET
• Security devices, i.e. Firewalls, VPN, AAA systems
• Web development and programming languages. e.g. Python, Perl, Ruby, Java, .Net