Job Description

Everforth ECS is seeking a Penetration Tester to work in the National Capital Region covering the Pentagon, Falls Church, and Fairfax

Please Note: This position is contingent upon contract award.

The War Data Platform (WDP) is a key initiative within the U.S. Department of War's (DoW) AI-First strategy introduced in early 2026. The WDP separates business and financial data from operational warfighting data, aiming to accelerate the deployment of artificial intelligence (AI) on the battlefield. The WDP extends to Unclassified, Secret, and Top Secret environments, and supports collaboration between Combatant Commands, Joint Staff directorates, Senior Executive Service leaders, and operational analysts.

The Penetration Tester executes structured offensive security assessments across WDP's classified and unclassified environments under senior testing leadership, validating the security posture of mission-critical network infrastructure, web applications, cloud components, and operational data platform services spanning NIPRNet, SIPRNet, and JWICS. This role directly supports WDP's Risk Management Framework compliance obligations, Authorization to Operate activities, and continuous monitoring requirements by delivering technically rigorous, evidence-based findings that enable timely remediation and strengthen the platform's defense-in-depth posture.

• Executes offensive security assessments supporting Department of War information systems across unclassified and classified environments under the direction of senior testing leadership.
• Conducts network and web application penetration testing activities to identify exploitable vulnerabilities, insecure configurations, and attack paths that bypass automated security controls.
• Performs reconnaissance, enumeration, exploitation, and post-exploitation activities using approved tools and techniques while adhering to established rules of engagement and operational safety constraints.
• Executes testing against operating systems, databases, web services, APIs, and cloud-hosted components to validate security control effectiveness and defense-in-depth posture.
• Documents technical findings including exploitation steps, evidence artifacts, and impact analysis in structured penetration testing reports.
• Collaborates with system owners, ISSOs, and cybersecurity engineers to deconflict testing activity and support timely remediation planning.
• Assists with red team activities by executing assigned attack scenarios and validating detection and response capabilities.
• Supports remediation verification through retesting of previously identified vulnerabilities to confirm corrective action effectiveness.
• Maintains detailed testing notes, screenshots, logs, and artifacts supporting Risk Management Framework assessment activities and authorization documentation.
• Contributes to continuous improvement of testing methodologies, toolkits, and playbooks while reinforcing program values of professionalism, discipline, accountability, and proactive cyber defense in support of mission assurance.
• Performs other duties as assigned.

Qualifications

• Current Secret security clearance with the ability to obtain and maintain a Top Secret (TS) security clearance.
• 3–10 years of experience in penetration testing, offensive security, vulnerability assessment, or a closely related cybersecurity discipline, with demonstrated hands-on experience conducting structured penetration testing engagements across network, web application, and cloud environments in federal, DoW, or enterprise settings.
• IAM Level I certification from an approved credential, including CompTIA Security+ CE, ISC² CAP, ISC² SSCP, or GIAC GSLC.
• Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.
• Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management).