Experienced Penetration Tester

B&M Cyber is seeking an experienced Penetration Tester to support cybersecurity testing activities for our Federal clients. The successful candidate will plan and conduct hands-on penetration testing across infrastructure, application, cloud, and identity environments and provide actionable recommendations to improve our clients' security posture. Candidates must be able to obtain a security clearance and be willing to work onsite at Federal client locations in Washington, D.Identify and document vulnerabilities, misconfigurations, and compliance issues through thorough examination of external and internal infrastructure, systems, and security controls. Develop and execute approved Rules of Engagement (RoE), test plans, and standard operating procedures (SOPs) aligned with client requirements, penetration testing best practices, and approved testing boundaries. Plan, scope, conduct, and document penetration testing across internal and external networks, web applications, APIs, databases, cloud services, Active Directory, and other identity technologies. Perform the full testing lifecycle, from non-intrusive scanning and vulnerability discovery through exploitation, privilege escalation, lateral movement, and other post-exploitation activities, within the approved RoE. Promptly escalate critical and high-risk findings to client leadership in accordance with the approved RoE. Prepare accurate, well-written technical reports that describe findings, exploitation procedures, risks, and actionable remediation recommendations, and present results to developers, system administrators, project managers, and senior Government stakeholders. Safeguard sensitive information encountered during testing (e.g., credentials, personally identifiable information, and controlled unclassified information) in accordance with client security policies. Manage assignments and changing priorities, meet deadlines, coordinate with stakeholders, and proactively identify, communicate, and help resolve risks and issues. Contribute to the continuous improvement of penetration testing methodologies, tools, and frameworks, and participate in technical reviews, knowledge sharing, and mentoring.

Experience independently planning, executing, documenting, and presenting complex penetration testing engagements. Ability to provide a past performance report or comparable documentation (e.g., a sanitized penetration test report you authored or detailed project examples) that demonstrates your competency level as a penetration tester. At least five (5) years of hands-on penetration testing experience across infrastructure (internal and external networks), application (web applications and APIs), cloud, and identity-centric (e.g., Ability to read and use results of various security testing tools, perform false-positive analysis and validation, and communicate results and recommended remediation actions to technical and non-technical audiences. Strong knowledge of network, application, cloud, and identity security and industry-standard penetration testing tools (e.g., Strong analytical, problem-solving, written and verbal communication, technical writing, and documentation skills, with attention to accuracy and completeness. Active Secret or Top Secret clearance. Bachelor's degree or higher in Cybersecurity or a related field. Experience supporting Federal, law enforcement, defense, intelligence community, or similarly sensitive environments. Working knowledge of relevant Federal cybersecurity requirements, NIST security testing guidance (e.g., NIST SP 800-115), OWASP security testing practices, and the MITRE ATT&CK framework. Experience serving as a senior technical specialist, technical lead, or subject matter expert, including reviewing technical work products and mentoring less experienced staff. Ability to automate testing, analysis, or reporting using Python, PowerShell, Bash, or similar languages. Additional relevant certifications such as GIAC Web Application Penetration Tester (GWAPT), GIAC Cloud Penetration Tester (GCPN), OffSec Web Expert (OSWE), Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), or similar.

Security and Clearance Requirements B&M Cyber is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, religion, sex, sexual orientation, gender identity, national origin, age, disability, protected veteran status, or any other legally protected basis, in accordance with applicable law.

B&M Cyber (B&M Consulting Group, Inc.) is a woman-owned small business (WOSB) with significant expertise and experience providing cybersecurity services to clients throughout the Federal government.