Security Software Engineer – Red Team Penetration Tester with Security Clearance

About the Role

RPI Group is seeking a skilled, driven Security Software Engineer to support Red Team penetration testing for a mission-focused Navy customer. If you are energized by complex technical challenges, enjoy finding and analyzing security weaknesses, and want your work to inform real-world defensive decisions, this role is for you.

Requirements

• Five (5) years experience in Linux with firm grasp/demonstrated knowledge; associated training: CompTIA Linux+ or FedVTE Linux+
• Five (5) years experience in Windows with foundational knowledge and good understanding of enterprise networks; associated training: Microsoft course (MCSA; various)
• Strong working knowledge of common penetration testing tools: Kali, Metasploit, NMAP, Cobalt Strike
• Associated training: Certified Ethical Hacker or Offensive Security Certified Professional
• Documented experience in at least one of the following:
  • Penetration Testing (government or contractor)
  • Red Team Operations (government or contractor)
  • Tool/Software Development (exploits/malware, C2, reverse engineering, bug bounties)
• Minimum certification as IAT Level II per DoD 8570.01, or successor
• Minimum certification as penetration tester with one of the following:
  • Offensive Security Certs: OSCP, OSCE, OSEE, OSWP
  • SANS Certs: GPEN (SEC560), GWAPT (SEC542), GXPN (SEC660), Advanced Web App Penetration Testing (SEC642), Red Team Operations and Threat Emulation (SEC564)
  • OSD Sponsored Cyber Operation Academy Course (COAC) graduates
• Capture the Flag (CTF) participation (DEFCON, Over-The-Wire, Hack the Box, USS Secure CTFs)
• Security research resulting in a Common Vulnerabilities and Exposures (CVE)
• Must be a U.S. Citizen and possess an Active Security Clearance

Skills

• Programming/Scripting: Python, C, C#, C++, Go, Perl, PowerShell
• Web Development/Web App Penetration Testing
• Virtualization: NSX, vCenter, vRealize Suite, Horizon View (VDI)
• Networking/Firewall: PAN-OS, FirePower, Nexus, IOS, ASA
• Storage: ONTAP, SnapMirror
• Identity & Access: Active Directory, Entra ID (Azure AD), SSO, MFA, Azure application integration, Identity Federation
• Automation: PowerShell, Power Automate, Logic Apps, Graph API
• Microsoft Entra ID and Microsoft 365 in a hybrid environment
• Experience with Palo Alto, Cisco, VMware, NetApp, and Microsoft products
• Extending or integrating on-premises AD with Entra ID
• Managing identity and access in Microsoft Entra ID
• Red Team operations in an MDE environment
• Cloud: AWS, Cloud Audit, Serverless and Microservice Architecture
• AWS services (EC2, S3, KMS, RDS) and security best practices
• Web Services penetration testing (RESTful and SOAP)
• Web Authentication protocols (OAuth2, SAML, LDAP)
• Web technologies: PHP, ASP, SQL databases, Java, HTML, NoSQL
• Debug and reverse engineer software
• Analyze Windows Events and Linux syslogs, boot logs, and dmesg logs
• Program and debug Web 2.0, Java, Perl, Ada, C++, Tcl/Tk scripts and GUIs using Microsoft Visual Studio and Rational ClearCase for software configuration management
• Recommend software modifications to mitigate known vulnerabilities
• Operate and administer computer systems running HP-UX, UNIX, Solaris, Linux, and Microsoft Windows
• Identify security flaws in compiled and human-readable source code
• Understand code utilizing real-time VxWorks and Lynx OS, CORBA, firewalls, and networking protocols
• Implement NSA-approved encryption technologies and devices
• Apply DISA Security Technical Implementation Guides (STIGs)
• Apply virtual hosting and server technology in system architectures
• Understand and apply deceptive technology such as honeypots in system architectures
• Participate in Code Reviews
• Perform Static Source Code Analysis
• Author recommendations for improving software and code design
• Contribute to a System Security Administrator and Operators Manual (SSAOM)

Pay

Salary Range: $110,000 to $150,000 Annually

Location: Dahlgren, VA