Penetration Testing Lead

Job Summary:

The Penetration Testing Lead (Part Time) is responsible for leading and managing penetration testing engagements, serving as the primary technical liaison with the client's security team. This role involves designing and executing controlled, evidence-based security tests to evaluate the resilience of the agency's sensitive data against internal attacker scenarios. The position requires up to 15 hours per week on a contract basis, with onsite presence needed for presentations, briefings, and report narration. Responsibilities:

• Own the overall penetration testing methodology and develop the Penetration Test Plan and Rules of Engagement.
• Lead exploitation, privilege escalation, and lateral-movement testing across cloud, network, application, and identity layers.
• Conduct authorized data-exfiltration simulations using synthetic data and coordinate detection testing with the client's monitoring team.
• Manually validate every critical security finding; scanner-only results are not acceptable.
• Present technical findings to both technical staff and senior leadership.
• Own the technical narrative and provide remediation guidance in the final report.

Required Skills & Certifications:

• 10+ years of hands-on offensive security and penetration testing experience, including AWS, network, and application testing.
• Active OSCP certification.
• Working knowledge of NIST SP 800-115, MITRE ATT&CK, OWASP, and PTES frameworks.
• Proven experience as both lead tester and client-facing technical contact.

Preferred Skills & Certifications:

• Advanced certifications such as OSEP, OSWE, GXPN, or GPEN.
• Prior experience with federal, Inspector General, or regulated-data environments (e.g., tax or healthcare data).

Special Considerations:

• Onsite attendance required for presentations, briefings, and report narration in Washington, DC.
• Engagement involves working with sensitive and regulated data under strict security controls.

Scheduling:

• Part-time contract role with up to 15 hours per week allocated.
• Flexible scheduling with requirement for onsite presence during key events.