Cyber Security Engineer

Job TitleCyber Security Evaluation Team MemberJob LocationPatuxent River, MDJob RequirementsTop Secret Polygraph Unspecified Career Level not specified $127,650 - $212,750Job DescriptionSalary Statement Estimated Starting Salary Range: USD $127,650.00/Yr. - USD $212,750.00/Yr. Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data.Performing as a member of Cyber Security Evaluation Team (CSET) providing guidance and subject matter expertise to government personnelSupporting offensive security/red team/adversarial emulation testingExecuting Red Team engagements in a variety of networks using real-world adversarial Tactics, Techniques, and Procedures (TTPs) from conception to report deliveryDeveloping comprehensive security testing strategies and programs to provide assurance that security controls are designed and operating effectivelyWorking independently but collaborate with cross-functional to provide security engineering consulting and control design recommendations to reduce riskConducting open-source intelligence gathering, network vulnerability scanning, exploitation of vulnerable services, lateral movement, install persistence in a target network(s), and manage C2 infrastructureSystematically analyzing each component of an application with the intent of locating programming flaws that could be leveraged to compromise the software through source code review or reverse engineeringDeveloping payloads, scripts and tools that weaponize new proof-of-concepts for exploitation, evasion, and lateral movementSafely utilize attacker tools, tactics, and procedures when in sensitive environments/devicesEvading EDR devices such as Windows Defender and Carbon Black to avoid detection by Defenders/behavioral based alerting in order to further the engagement objectivesDemonstrating expertise in the following: Active Directory, Software Development, Incident Response, or Cloud InfrastructureCarefully document and log all exploitation activitiesDocumenting identified vulnerabilities and researching corrective/remediation actions in order to recommend a risk mitigation technique(s)Demonstrating new vulnerabilities and assist Network Defenders (Blue Team) with the refinement of detection capabilitiesMaintaining knowledge of applicable Red Team policies, Standing Ground Rules, regulations, and compliance documentsCommunicating effectively with team members especially during an engagementAbility to think unconventionally in order to develop adversarial TTPsKeeping current with TTPs and the latest offensive security techniquesRequirementsBachelor's degree with a focus in computer science, computer information systems, engineering, mathematics, management information systems, cybersecurity, cyber operations, or a related discipline with corresponding experience and demonstrated mastery of relevant computer science topics7+ years of cyber adversarial emulation experience, to include penetration testing of modern Windows and Linux operating systems, IP-based networks and protocols, 802.11 networks, and/or web applications, hardware hacking, software defined networks/RFIntermediate knowledge of known Advanced Persistent Threat (APT) actor Techniques, Tactics, and Procedures (TTPs), to include familiarity with terminology from Mitre ATT&CK® used to describe TTPs used in cyber attacksIntermediate knowledge of techniques and tools used for exploit development of common operating systems, software debugging, and application fuzzingIntermediate knowledge of tools and techniques used for incident response, reverse engineering, and digital forensicsSuperior oral communication skills, including the ability to project confidence and enthusiasm, in the following core areas: formal presentations; soliciting goals and requirements from range users; explaining adversarial emulation in the context of testing and training events; effectively communicating event and environment requirements to CSET members; explaining cost estimates based on estimated levels of CSET effort; managing expectations as relevant to CSET TTPs; and explaining technical nuances and significant attributes of advanced cyber attacks to non-cyber-savvy audiencesSuperior technical writing skills, including the ability to author, review, and provide input and feedback to documents drafted by CSET personnel, as well as the ability to create persuasive and impactful technical briefing materials as relevant to range training and test eventsAbility to work independently and to collaborate with range and event leadership, CSET team members, users, and other event stakeholdersRequired/Maintain IAT Level II or IAM Level II 8570 certificationsIn addition to meeting the applicable cyber security workforce (CSWF) requirements for Computer Network Defenders (CND) Auditors (DoD 8570) or Vulnerability Assessment Analysts (SECNAV 5239.2), CSET members must obtain one or more of the following vendor certifications within 6 months of being hired:Offensive Security Certified Professional (OSCP)GIAC Certified Exploit Researcher and Advanced Penetration Testers (GXPN)Desired SkillsMaster's degree with a focus in computer science or cybersecurity10+ years of experience supporting the execution of Department of Defense (DoD) offensive cyber operations (OCO) or defensive cyber operations (DCO) as a civilian, contractor, or uniformed personnelRed Team, Computer Operator or Exploitation Analyst experience with Threat Systems Management Office (TSMO), US Air Force, US Navy or National Security Agency (NSA) / Cyber Mission Force teamsExperience with OT, IoT, XIoT is a plusAbout UsScientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients. SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.EEO StatementScientific Research Corporation is an equal opportunity employer that does not discriminate in employment. All qualified applicants will receive consideration for employment without regard to their race, color, religion, sex, age, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other protected characteristic under federal, state or local law. Scientific Research Corporation endeavors to make accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact View email address on click.appcast.io for assistance. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.