Penetration Tester

Tharros has an immediate opportunity to support the US Navy with operational test and evaluation support. The Penetration Tester will assist in the development of cyber test plans, execute cyber tests, and report cyber test results. In this role you will conduct cyber tests on operational systems, in laboratory environments, or in cyber range environments. Testing may be against physical, virtualized, or cloud-based systems. This position shall leverage all authorized resources and analytic techniques to penetrate/access targeted networks and systems under test in support of OPTEVFOR's cyber OT&E mission. Team member will perform these duties under the supervision of the 01D Cyber Operations Officer.

Responsibilities

Assist in the development of cyber test plans, execute cyber tests, and report cyber test results; Conduct cyber tests on operational systems, in laboratory environments, or in cyber range environments; Leverage authorized resources and analytic techniques to penetrate/access targeted networks and systems under test in support of OPTEVFOR's cyber OT&E mission; Review and become proficient in OPTEVFOR cyber T&E concept of operations, SOPs, policies and guidance; Maintain and participate in the development of 01D SOPs and documentation for DCAT authorization; Research, review, prioritize, and submit operational requirements for acquisition of equipment or cyber capabilities; Support development and execution of TTPs for penetration testing or Red Teaming; Research adversary cyber actors' TTPs and integrate findings into cyber survivability test planning and execution; Participate in OPTEVFOR Cyber Test planning, including open-source research, check point meetings, test plan objective development and review, and test planning site visits; Participate in test preparation, including site pre-test coordination visits, red team test plan review, and preparation of OPTEV-RT test assets; Execute test events, including Cooperative Vulnerability Penetration Assessments, Adversarial assessments, and Cyber Tabletops; Use OPTEVFOR provided and NAO approved cyber assessment tools (e.g. Core Impact, Nmap, Burp, Metasploit, and Nessus); Exploit discovered vulnerabilities and misconfigurations to accomplish test objectives; Ensure tests are conducted safely, in accordance with the test plan, and OPTEVFOR policies; Follow JFHQ-DODIN deconfliction procedures; Verify collected data for accuracy and completeness; Participate in the post-test iterative process, including generation of documents such as deficiency/risk sheets; Document lessons learned; Participate in capture the flag events, cyber off sites, and external engagements; Attend OPTEVFOR required meetings in support of OT&E; Generate and update documentation to maintain DCAT authorization compliance; Process exfiltrated data for analysis and/or dissemination to customers; Test and evaluate locally developed tools for operational use and implementation

Requirements

Minimum 3 years' experience performing any combination of: penetration testing, red teaming, or exploitation development; Minimum 3 years' with proficiency in leading red team operators in penetration testing/red teaming to accomplish assigned test objectives; Offensive Security Certified Professional (OSCP) or equivalent certification; Proficient in multiple offensive tools, including Metasploit, Cobalt Strike, Core Impact, Burp Suite, Nessus, SharpHound/BloodHound; Ability to validate functionality and safety of offensive tools (e.g. exploits) given the source code and document the results; Ability to detect malicious activity of a program using dynamic analysis techniques and document the results; Independently operate to conduct penetration testing/red teaming to accomplish assigned test objectives; Skill in assessing current tools to identify needed improvements; Skill in knowledge management, including technical documentation techniques (e.g., Wiki page); Knowledge of current software and methodologies for active defense and system hardening; Knowledge of encryption algorithms and cyber capabilities/tools (e.g., Transport Layer Security, Pretty Good Privacy); Knowledge of evasion strategies and techniques; Knowledge of forensic implications of operating system structure and operations; Knowledge of host-based security products and how they affect exploitation and vulnerability; Knowledge of network administration; Knowledge of network construction and topology; Knowledge of security hardware and software options, including the network artifacts they induce and their effects on exploitation; Knowledge of security implications of software configurations; Knowledge of the fundamentals of digital forensics in order to extract actionable intelligence; Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations; Knowledge of Unix/Linux and Windows operating systems structures and internals (e.g., process management, directory structure, installed applications); Knowledge of network collection procedures to include decryption capabilities/tools, techniques, and procedures; Process exfiltrated data for analysis and/or dissemination to customers; Test and evaluate locally developed tools for operational use; Skill in testing and evaluating tools for implementation; Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools; Excellent written and verbal communication skills

Benefits

Competitive compensation; Comprehensive benefits including medical, dental, vision and disability coverage; Savings & retirement; Paid leave; Tharros Leadership Development Program; Team Member Referral Bonuses; Training & Certification Reimbursement of up to $5,250 per year; Training opportunities, tools and resources