Penetration Tester

Job Description

Purple Jay is a veteran-owned IT and InfoSec company that guides government agencies and private organizations into the right balance of business productivity and implements security measures to help maximize their outcomes and achieve their mission. We believe that effective cybersecurity solutions must go beyond simply protecting data and systems – they must align with the mission to enable and empower progress. Our teams are built to provide cross-domain services with highly skilled and trained personnel supported by cross-matrix, agile teams and our proprietary digital solutions that have a track record of success. Our positively charged approach intends to exceed client’s minimum requirements, reduce client and organizational risk, and maximize the return on investment.

OUR COMPANY CULTURE IS BUILT WITH TEAM MEMBERS THAT…

\n
• Have a curious and intellectual mind who are inclined to ask “why”.
\n
• Use creative thinking and adaptive decision-making to solve problems.
\n
• Value their contribution and the contribution of others on the team.
\n
• Are passionate about learning and developing skills to overcome challenges.
\n
• Look to leverage their knowledge or experience to advance within the InfoSec Industry.
\n
• Can connect with people of diverse backgrounds and communication styles, through empathy and clear verbal, visual, and written communication.
\n

ROLE OVERVIEW:

Our Threat Resilience team answers specific security questions for federal programs with hands-on evidence, inside a fixed window . When a system’s risk can’t be settled by documentation and vendor attestation alone, we test it directly from an attacker’s point of view. We then put what we find in the context of real threats and give the decision maker a defensible answer with practical fixes. Engagements range from a bounded technical check, to a focused assessment across several components, to a deep evaluation spanning multiple trust boundaries.

As a mid-level Penetration Tester, you’ll be a core operator on these engagements. You’ll test under a senior engagement lead and build the proof-of-concept tooling that confirms or rules out an attack path. Then you’ll turn your findings into evidence and recommendations that a government Authorizing Official can act on .

\n
• This position is based in Ashburn, VA, and requires travel for on-site assessments at customer facilities.
\n
• Applicants must hold the Offensive Security Certified Professional (OSCP) certification or have 3 to 5 years of hands-on professional penetration testing experience.
\n
• Applicants must be able to obtain and maintain a federal background investigation (Public Trust or higher).
\n
• Applicants must be a US Citizen.
\n

RESPONSIBILITIES:

Purple Jay teams are cross-functional and cross-matrixed to aid in the effective delivery of services and digital solutions. The role responsibilities include but are not limited to:

Plan and execute hands-on security assessments, including:

\n
• Internal and external network penetration tests, including Active Directory enumeration and attack-path analysis, privilege escalation, credential attacks, and lateral movement
\n
• Web application and API testing for flaws in authentication, authorization, session management, and business logic
\n
• Adversary emulation using realistic tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK, with commercial and open-source offensive tooling
\n
• Assessments of cloud and SaaS environments, wireless and RF systems, and specialized environments such as industrial control systems, robotic automation, and medical devices, using safe, non-disruptive methods suited to production conditions
\n
• Physical security assessments and authorized social engineering engagements when they are in scope
\n

Hunt, detect, and validate:

\n
• threats in endpoint, network, and log telemetry, starting from a hypothesis, to find evidence of compromise and check whether defenders can see attacker activity
\n
• detection and response capabilities alongside defensive teams in purple team exercises
\n

Model, develop, and recommend:

\n
• threat models that tie each finding to the system’s architecture, trust boundaries, likely adversaries, and mission impact, so real exploitable risk stands apart from theoretical noise
\n
• proof-of-concept exploits and custom tooling in Python to confirm attack paths and chained weaknesses
\n
• practical fixes and mitigations, including compensating controls the customer already owns, confirmed through regression testing
\n

Document, report, and communicate:

\n
• reproducible evidence, maintaining chain of custody and protecting credentials, PII, and sensitive data throughout every engagement
\n
• clear findings with CVSS 4.0 severity, CWE and OWASP classification, reproduction steps, and prioritized remediation, plus plain-language summaries for non-technical readers
\n
• results within defined Rules of Engagement, supporting coordinated disclosure with vendors and system owners
\n
• Use AI-assisted tooling throughout the work, with a human in the loop and personal ownership of every result.
\n
• Help build and refine the team’s playbooks, test plans, and reporting templates.
\n

PROFESSIONAL SKILLS

\n
• Clear written communication for both engineering and executive audiences.
\n
• Sound judgment in production environments, including knowing when to stop, escalate, or ask.
\n
• The ability to quickly build working proficiency in unfamiliar technologies. Our assessment targets range from enterprise networks and cloud services to industrial automation, medical devices, and physical facilities, and each engagement can bring a new domain.
\n
• Strong sense of personal accountability regarding decision-making and coordinating across different project and department teams
\n
• Experience working in a high-level collaborative environment and promoting a teamwork mentality.
\n
• Proven ability to build and maintain effective relationships with stakeholders at all levels, including technical teams, management, and clients.
\n

TECHNICAL SKILLS

\n
• Hands-on network penetration testing experience across Linux and Windows environments, including Active Directory attacks, privilege escalation, lateral movement, and pivoting.
\n
• Web application and API testing experience covering the OWASP Top 10, authentication and authorization flaws, and business logic issues.
\n
• Practiced with offensive security tooling such as Burp Suite Professional, Nessus, Nmap, Metasploit, Cobalt Strike, BloodHound, Impacket, and NetExec.
\n
• Threat hunting experience, or a solid working knowledge of how attacker activity shows up in EDR, SIEM, and network telemetry.
\n
• A strong understanding of threat modeling. You don’t stop at finding vulnerabilities. You explain what they mean for the specific system and mission, how an adversary would chain them together, and which fixes or mitigations matter most.
\n
• Proficiency in Python or a similar language for exploit development, automation, and tooling.
\n
• Proven skill using AI tooling for human-in-the-loop security testing. You use AI to speed up reconnaissance, analysis, scripting, and reporting, and you independently verify everything it produces. Every finding you deliver is one you can explain and defend yourself.
\n

PREFERRED QUALIFICATIONS

\n
• Advanced certifications such as OSEP, OSWE, CRTO, GPEN, GXPN, GCTH, or Burp Suite Certified Practitioner.
\n
• Physical penetration testing experience.
\n
• Social engineering experience, including phishing, pretexting, and help desk or account recovery testing.
\n
• Red team or purple team experience.
\n
• Mobile application testing on Android and iOS.
\n
• Testing of identity and federation protocols such as OAuth 2.0, OIDC, SAML, and WebAuthn.
\n
• Cloud security testing in AWS, Azure, or GCP.
\n
• OT/ICS security experience with PLCs, industrial protocols, or robotics (GICSP or GRID a plus).
\n
• Wireless and RF assessment experience, including software-defined radio tools.
\n
• Medical device or IoT security experience.
\n
• Familiarity with NIST SP 800-53A, NIST SP 800-115, and the Risk Management Framework, or experience supporting federal authorization decisions.
\n
• An active security clearance.
\n

TRAVEL REQUIREMENTS

\n
• Travel within the continental U.S. is required to support on-site assessments at customer facilities (up to 10% of the time).
\n
• Travel greater than 50 miles from the primary work location will be reimbursed in accordance with federal and local policies.
\n

ABOUT THE BENEFITS

PURPLE JAY IS ALL ABOUT THE BENEFITS! WE OFFER…

\n
• Medical, Dental & Vision benefits as well as company-paid Life & Disability Insurance policies.
\n
• Optional 401k, additional Disability, Life, and Voluntary AD&D plans available.
\n
• Paid Federal holidays and up to two weeks of accrued PTO (Paid Time Off).
\n
• An opportunity for career growth with training and boot camps.
\n
• The required technical equipment will be provided by Purple Jay.
\n
• An empowering culture that values your voice while challenging you to get better every day.
\n

Purple Jay, LLC is an Equal Opportunity Employer. All applicants are considered without regard

to race, color, ancestry, national origin, gender/gender identity, sexual orientation, marital and family status, religion and religious belief, age, disability, results of genetic information, and service in the military.