渗透测试员
Penetration Tester
描述
Dragonfli Group 是一家网络安全和IT咨询公司，为联邦机构和财富100强企业提供服务。总部位于华盛顿特区，Dragonfli 在现场、混合和完全远程环境中帮助客户保护关键任务系统。
Dragonfli Group 正在寻找一名中高级渗透测试员加入一个整合的企业渗透测试项目，该项目支持一家大型联邦机构。在此全远程职位中，您将按照结构化的规划、发现、测试和报告阶段，计划并执行授权的渗透测试，覆盖网络、终端、无线、数据库、应用和基础设施环境。您将制定行动规则、执行计划和可决策的报告，直接与系统负责人和SOC人员协调以确认范围和安全阈值，并验证因配置错误、过时软件和弱访问控制而产生的可利用条件。您还将支持CISA WAS和FAST发现的验证、KEV暴露项以及外部资产发现的验证，并协调重新测试以确认关闭情况，使用经批准的AI驱动工具提高侦察效率和ATT&CK/ATLAS映射，同时保持人工监督。此职位需要大约5至8年的相关经验，独立或主导执行渗透测试任务。
这是一项涉及大型美国联邦机构的多年合同职位。有之前联邦承包经验的候选人优先考虑。要求具备美国公民身份或永久居留权。如果被录用，所有与此职位相关的工必须在美国本土大陆进行。
这是一项全远程职位。
主要职责：
- 使用结构化的规划、发现、测试和报告阶段，在网络、终端、无线、数据库、应用和基础设施环境中计划并执行授权的渗透测试。
- 制定并定制行动规则、执行计划、每日状态更新和最终报告输入，用于分配的评估任务。
- 与系统负责人、SOC人员和其他利益相关者协调，确认范围、测试窗口、前提条件、安全阈值和停止/暂停程序。
- 验证因配置错误、过时软件、弱访问控制、不完整的控制实施和可利用的攻击路径而产生的漏洞。
- 支持CISA WAS、CISA FAST、KEV暴露项和外部资产发现的验证，并协调重新测试以确认关闭情况。
查看英文原文
Description
Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.
Dragonfli Group is seeking a Mid-Level Penetration Tester to join a consolidated enterprise Penetration Testing program supporting a large federal agency. In this fully remote role, you will plan and execute authorized penetration tests across network, endpoint, wireless, database, application, and infrastructure environments, following structured Planning, Discovery, Testing, and Reporting phases. You will develop Rules of Engagement, Execution Plans, and decision-ready reporting, coordinate directly with system owners and SOC personnel to confirm scope and safety thresholds, and validate exploitable conditions arising from misconfigurations, outdated software, and weak access controls. You will also support validation of CISA WAS and FAST findings, KEV exposure items, and coordinate retesting to confirm closure, using approved AI-enabled tools to improve reconnaissance and ATT&CK/ATLAS mapping while maintaining human oversight. This role calls for approximately 5 to 8 years of relevant experience leading or independently executing penetration testing engagements.
This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.
This is a fully remote position.
Key Responsibilities:
- Plan and execute authorized penetration tests across network, endpoint, wireless, database, application, and infrastructure environments using structured Planning, Discovery, Testing, and Reporting phases.
- Develop and tailor Rules of Engagement, Execution Plans, daily status updates, and final reporting inputs for assigned assessments.
- Coordinate with system owners, SOC personnel, and other stakeholders to confirm scope, test windows, prerequisites, safety thresholds, and stop/pause procedures.
- Validate vulnerabilities arising from misconfigurations, outdated software, weak access controls, incomplete control implementation, and exploitable attack paths.
- Support validation of CISA WAS, CISA FAST, KEV exposure, and external-facing asset findings, and coordinate retesting to confirm closure.
- Use approved automated and AI-enabled tools to improve reconnaissance, testing efficiency, ATT&CK/ATLAS mapping, evidence development, and reporting while maintaining human oversight.
Requirements
Must-Have
- U.S. Citizenship or Permanent Residency (required for this federal engagement)
- Approximately 5 to 8 years of experience conducting or leading penetration testing engagements
- Demonstrated ability to plan and execute assessments across network, endpoint, wireless, database, application, and infrastructure environments
- Experience developing Rules of Engagement, Execution Plans, and formal, decision-ready reporting for stakeholders
- Experience coordinating directly with system owners and SOC personnel on scope, safety thresholds, and stop/pause procedures
- Ability to work fully remote with reliable, secure connectivity
Preferred / Nice-to-Have
- Previous federal contracting experience
- Experience with CISA WAS, CISA FAST, and KEV validation and retest workflows
- Familiarity with MITRE ATT&CK and ATLAS mapping
- Advanced certifications such as OSCP, OSCE, GPEN, or GXPN
- Experience integrating AI-enabled tools into testing workflows while maintaining human oversight of results
Skill(s)
Technical Skills
- End-to-end penetration testing across network, endpoint, wireless, database, application, and infrastructure environments
- Rules of Engagement and Execution Plan development
- Vulnerability validation and exploit chain analysis
- CISA WAS/FAST and KEV validation and retesting
- MITRE ATT&CK/ATLAS mapping and AI-enabled testing tools
Soft Skills
- Stakeholder coordination with system owners and SOC teams
- Clear, decision-ready written and verbal reporting
- Sound judgment around safety thresholds and stop/pause procedures
- Ability to lead an assessment independently with minimal oversight
- Mentorship of junior testing staff
Benefits
- Dragonfli Group offers a comprehensive benefits package that includes:
- Medical, Multiple POS health plan options including an HSA-compatible plan
- Dental, PPO coverage for preventive, basic, and major services
- Vision, Annual exam, frames, lenses, and contact lens allowance
- 401(k), Employer match up to 5% of eligible compensation
- Long-Term Disability, 100% employer-paid coverage at 50% of pre-disability earnings
- Life Insurance and AD&D, 100% employer-paid coverage valued at $10,000 each
- PTO, 15 to 25 days annually based on tenure
- Paid Federal Holidays, All 11 federal holidays observed
Originally posted on Himalayas