Penetration Tester

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. No Job ID etc. Remove boilerplate. We need to parse the description. Key info: - Work Location: Mark Center, Alexandria, Virginia (maybe schedule? Not schedule but location; we could put under a section? There's no explicit heading for location; maybe we can include in a

under About the role? The instruction: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can create sections as appropriate. We have: About the role: description of role: "Leidos is seeking experienced Penetration Tester to support the Defense Manpower Data Center (DMDC) CyberPRIMES program...". That's about role. Responsibilities: list of primary responsibilities (the long list). We'll put as

• . Requirements: maybe Basic Qualifications. Qualifications: maybe Preferred Qualifications. Skills: maybe not separate; could combine with qualifications. Benefits: The posting mentions "Pay And Benefits" section with generic benefits: "competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." Also link to details. That's specific enough? It says "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." That's specific benefits. So we can include Benefits section. Pay: Pay Range $87,100.00 - $157,450.00. So include Pay section. Schedule: Not mentioned. No schedule info. So omit Schedule. Also we might include Work Location maybe under About the role or a separate section? Not in list of headings; but we could include as a paragraph under About the role. We must not include boilerplate like "About Leidos", "Securing Your Data", "Commitment to Non-Discrimination", etc. Remove those. Also remove "If you're looking for comfort..." etc. Also remove "Original Posting September 22, 2026" etc. Also remove "For U.S. Positions: While subject to change..." etc. Also remove "Pay And Benefits" heading? We'll create our own Benefits section. We need to preserve all substantive information: role description, responsibilities, basic qualifications, preferred qualifications, pay range, benefits, work location. We must not invent or summarize away detail. Must preserve all specifics. We need to be careful not to omit any details from responsibilities list. The responsibilities list is long; we need to capture each bullet as
• . We'll need to parse the responsibilities paragraph into bullet points. Let's extract responsibilities from the text: "Primary Responsibilities Conduct Government-selected penetration-testing assessments and threat-hunting activities in accordance with established DMDC procedures and the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115. Develop assessment plans, methodologies, test objectives, rules of engagement, and technical approaches appropriate to the target environment. Execute authorized penetration-testing activities against networks, systems, applications, web applications, and code. Identify vulnerabilities, exploitable configurations, attack paths, and weaknesses that could be used by a malicious actor. Assess the practical exploitability and potential mission impact of identified security weaknesses. Research emerging and existing threats, attack techniques, vulnerabilities, and adversary behaviors that may affect DHRA systems. Develop testing methodologies designed to identify areas of risk likely to be targeted by an intruder. Conduct threat-hunting activities to identify suspicious or malicious activity that may not be detected through routine monitoring. Perform cooperative testing with cybersecurity-tool administrators, Security Operations Center (SOC) analysts, incident-response personnel, and Security Information and Event Management (SIEM) content developers. Validate whether enterprise cybersecurity tools properly detect, generate alerts for, and support analysis of authorized offensive activity. Identify detection or alerting gaps discovered during testing and provide technical findings to the appropriate cybersecurity teams. Support pre-audit penetration testing to identify exploitable weaknesses before formal assessments or reviews. Apply established penetration-testing methodologies and approved commercial or open-source offensive-security tools. Support Red Team and Blue Team activities designed to evaluate and improve enterprise cybersecurity defenses. Document testing activities, technical evidence, vulnerabilities, exploitation results, and risk findings. Develop post-assessment out-briefs and final assessment reports for Government stakeholders. Provide technically actionable remediation recommendations based on assessment findings. Coordinate findings with system owners, application teams, network engineers, cybersecurity personnel, SOC analysts, and incident responders. Maintain Government-Furnished Equipment and approved penetration-testing systems, laptops, software, and tools required to perform assessments. Protect assessment data, technical artifacts, credentials, exploit information, and other sensitive testing information in accordance with Government requirements." We need to split into separate items. Each sentence seems a separate responsibility. We'll create
• for each sentence. Now Basic Qualifications: "Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline and 4 – 8 years of prior relevant experience in order to operate within the scope contemplated by the level. Specific experience, education and training may be considered in lieu of degree.Experience conducting penetration testing, vulnerability assessment, threat hunting, offensive security, or comparable cybersecurity assessment activities. Experience assessing enterprise networks, systems, applications, web applications, or code for exploitable cybersecurity weaknesses. Experience using commercial or open-source penetration-testing and offensive-security tools. Understanding of common attack techniques, exploitation methods, network protocols, operating systems, and application-security concepts. Experience developing penetration-testing methodologies, test plans, or technical assessment procedures. Experience documenting vulnerabilities, technical evidence, exploitation results, and remediation recommendations. Ability to distinguish theoretical vulnerabilities from weaknesses that present practical exploitation or mission risk. Ability to communicate technical findings clearly to system owners, engineers, cybersecurity personnel, and Government stakeholders. Ability to conduct authorized offensive-security activities within defined rules of engagement and Government-approved procedures. U.S. Citizenship required. Active Secret security clearance required." We'll split into bullet points. Preferred Qualifications: "Experience conducting penetration testing within Department of Defense or Federal environments. Experience applying National Institute of Standards and Technology Special Publication 800-115 testing methodologies. Experience conducting network, web-application, application, and source-code security assessments. Experience performing threat hunting or adversary-emulation activities. Experience supporting Red Team and Blue Team exercises. Experience working with Security Operations Center analysts and incident responders during cooperative testing. Experience validating SIEM detections, security alerts, or cybersecurity-tool effectiveness using controlled offensive activity. Experience conducting pre-audit or pre-authorization security assessments. Experience researching emerging vulnerabilities, attack techniques, and adversary tradecraft. Experience developing executive and technical penetration-testing out-briefs and assessment reports. Familiarity with Department of Defense Risk Management Framework processes. Familiarity with DHRA, DMDC, or comparable Department of Defense enterprise environments." We'll bullet. Benefits: "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits." We'll include bullet list maybe. Pay: "Pay Range $87,100.00 - $157,450.00 The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law." We'll include that as a paragraph. Work Location: "Work Location: Mark Center, Alexandria, Virginia". We'll include as a paragraph maybe under About the role. Now we need to output only HTML fragment, no /, no markdown fences. We'll structure:

  About the role

  Leidos is seeking experienced Penetration Tester to support the Defense Manpower Data Center (DMDC) CyberPRIMES program. Leidos is a major partner on the contract and will provide a substantial portion of the cybersecurity workforce supporting the Defense Human Resources Activity (DHRA) and DMDC. The Penetration Tester will conduct Government-directed penetration testing and threat-hunting assessments across DHRA systems, networks, applications, and supporting technologies. This position will identify exploitable weaknesses, validate the effectiveness of defensive cybersecurity capabilities, and provide actionable findings that help system owners and cybersecurity teams reduce risk. Work Location: Mark Center, Alexandria, Virginia

  Responsibilities

  • Conduct Government-selected penetration-testing assessments and threat-hunting activities in accordance with established DMDC procedures and the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115.
  • Develop assessment plans, methodologies, test objectives, rules of engagement, and technical approaches appropriate to the target environment.
  • Execute authorized penetration-testing activities against networks, systems, applications, web applications, and code.
  • Identify vulnerabilities, exploitable configurations, attack paths, and weaknesses that could be used by a malicious actor.
  • Assess the practical exploitability and potential mission impact of identified security weaknesses.
  • Research emerging and existing threats, attack techniques, vulnerabilities, and adversary behaviors that may affect DHRA systems.
  • Develop testing methodologies designed to identify areas of risk likely to be targeted by an intruder.
  • Conduct threat-hunting activities to identify suspicious or malicious activity that may not be detected through routine monitoring.
  • Perform cooperative testing with cybersecurity-tool administrators, Security Operations Center (SOC) analysts, incident-response personnel, and Security Information and Event Management (SIEM) content developers.
  • Validate whether enterprise cybersecurity tools properly detect, generate alerts for, and support analysis of authorized offensive activity.
  • Identify detection or alerting gaps discovered during testing and provide technical findings to the appropriate cybersecurity teams.
  • Support pre-audit penetration testing to identify exploitable weaknesses before formal assessments or reviews.
  • Apply established penetration-testing methodologies and approved commercial or open-source offensive-security tools.
  • Support Red Team and Blue Team activities designed to evaluate and improve enterprise cybersecurity defenses.
  • Document testing activities, technical evidence, vulnerabilities, exploitation results, and risk findings.
  • Develop post-assessment out-briefs and final assessment reports for Government stakeholders.
  • Provide technically actionable remediation recommendations based on assessment findings.
  • Coordinate findings with system owners, application teams, network engineers, cybersecurity personnel, SOC analysts, and incident responders.
  • Maintain Government-Furnished Equipment and approved penetration-testing systems, laptops, software, and tools required to perform assessments.
  • Protect assessment data, technical artifacts, credentials, exploit information, and other sensitive testing information in accordance with Government requirements.

  Requirements

  • Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related technical discipline and 4 – 8 years of prior relevant experience in order to operate within the scope contemplated by the level.
  • Specific experience, education and training may be considered in lieu of degree.
  • Experience conducting penetration testing, vulnerability assessment, threat hunting, offensive security, or comparable cybersecurity assessment activities.
  • Experience assessing enterprise networks, systems, applications, web applications, or code for exploitable cybersecurity weaknesses.
  • Experience using commercial or open-source penetration-testing and offensive-security tools.
  • Understanding of common attack techniques, exploitation methods, network protocols, operating systems, and application-security concepts.
  • Experience developing penetration-testing methodologies, test plans, or technical assessment procedures.
  • Experience documenting vulnerabilities, technical evidence, exploitation results, and