Senior Penetration Tester

Senior Penetration Tester

Location: 1915 Health Services Way, Raleigh, NC 27607 (Hybrid)

Duration: 1 year

Description:

Seeking a Senior Penetration Tester to conduct authorized network & infrastructure penetration testing to identify, validate, & demonstrate security weaknesses.

Minimum 7 10 years of hands-on experience in penetration testing or offensive security is required.

Minimum 7 years of experience in:

• Demonstrated expertise in network and infrastructure security testing.
• Strong understanding of: TCP/IP, DNS, DHCP, VPN, firewalls, IDS/IPS, Windows and Linux system internals, and Active Directory attack paths and defenses.
• Advanced proficiency with penetration testing tools such as: Nmap, Nessus, Metasploit, Burp Suite, BloodHound, NetExec, PingCastel Analysis tools
• Experience producing standard penetration testing reports.
• Familiarity with security frameworks and standards, including: NIST SP 800-53, 800-115, 800-61, MITRE ATT&CK, and OWASP Testing Guide.
• Experience working within regulated or high-security environments.
• Strong understanding of legal, ethical, and compliance requirements for penetration testing.

The Senior Penetration Testing Contractor will:

• Plan and execute internal and external penetration tests for network and infrastructure environments
• Perform vulnerability identification, validation, and controlled exploitation

Assess security posture across:

• Network devices (firewalls, routers, switches)
• On-premise servers and operating systems (Windows, Linux, Unix)
• Active Directory and identity infrastructure
• Remote access solutions and VPNs
• Cloud environments (where applicable)

Simulate advanced threat actor techniques including:

• Privilege escalation
• Lateral movement
• Credential compromise
• Persistence mechanisms

• Evaluate security configurations and control effectiveness
• Conduct testing in accordance with approved Rules of Engagement
• Prepare and deliver formal penetration testing reports suitable for executive, audit, and technical audiences
• Support remediation validation and follow-up testing as required