Senior Penetration Tester / Vulnerability Assessment Engineer

Tharros is seeking a Senior Penetration Tester / Vulnerability Assessment Engineer to support DHS by identifying, assessing, and validating vulnerabilities across cloud and on-premise environments. This role focuses on expert-led, manual testing and includes on-site work in a Government SCIF in Washington, DC.

Responsibilities

• Conduct penetration tests across the DHS IE portfolio using established methodologies, including guidance such as MITRE ATT&CK and OWASP, covering activities from rules of engagement through exploitation, post-exploitation, and reporting.
• Apply manual testing techniques to uncover vulnerabilities that automated tools may miss.
• Validate SOC incident response procedures through controlled testing activities.
• Perform software assurance via vulnerability and compliance testing for software requests, including providing recommendations for approval.
• Execute source code reviews using a combination of automated tools and manual review processes.
• Carry out vulnerability assessments and support supply chain risk management (SCRM) reviews.
• Maintain and manage the security posture of the penetration testing kit used for testing activities.
• Update and maintain penetration testing, SCRM, and vulnerability assessment SOPs.

Requirements

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science, or a minimum of 10 years of experience in IT or cybersecurity.
• At least 7 years of experience in penetration testing or vulnerability assessment.
• Active TS/SCI clearance and U.S. citizenship, with willingness to undergo a DHS counterintelligence-scope polygraph.
• Knowledge of penetration testing methodologies and frameworks, including MITRE ATT&CK, OWASP, and PTES.
• Knowledge of software assurance and secure code review practices.
• Understanding of common attack vectors across network, application, and cloud layers.
• Ability to perform manual exploitation using tools such as Burp Suite, Metasploit, or Core Impact.
• Skill in static code analysis using tools such as SonarQube or Fortify.
• Ability to write clear penetration test reports that include recommended corrective actions.
• Proficiency with Microsoft Office Suite, including Teams or comparable chat and video conferencing tools.
• Excellent written and oral communication skills.

Technologies

• MITRE ATT&CK
• OWASP
• PTES
• Burp Suite
• Metasploit
• Core Impact
• SonarQube
• Fortify
• Microsoft Office Suite
• Teams
• AWS
• Azure

Desired

• Certifications such as OSCP, GPEN, GWAPT, CEH, or CISSP.
• Experience with cloud (AWS, Azure) or Cross Domain Solution testing.