Penetration Tester

Role Overview

Core Responsibilities & Expanded Penetration Testing Duties

• RMF & Security Control Testing: Provide senior-level technical expertise to validate, assess, and challenge security controls throughout the RMF lifecycle. Direct and participate in rigorous testing phases during formal authorization assessments.
• Full-Scope Penetration Testing: Plan, scope, and execute advanced network-level and application-level penetration tests (both black-box and white-box) using established methodologies, framework protocols, and custom exploitation techniques.
• Red Teaming & Simulation: Emulate sophisticated adversary tactics, techniques, and procedures (TTPs) to evaluate the resilience of enterprise architectures, equipment, and services against live threats.
• Vulnerability Assessment & Research: Lead active research efforts into emerging technologies, novel exploits, and zero-day vulnerabilities relevant to information systems security to proactively defend agency assets.
• Post-Exploitation & Risk Analysis: Analyze penetration testing results to determine lateral movement potential, data exfiltration vectors, and the true business or mission impact of discovered vulnerabilities.
• Regulatory Interpretation & Reporting: Translate complex federal and agency-specific security regulations into actionable engineering and testing criteria. Deliver comprehensive technical risk reports and executive-level briefs detailing mitigation roadmaps for system owners.

Required Qualifications & Experience Matrix

• Experience Threshold: Minimum of 12 years of directly related work experience in information security and technical testing.
• Education Substitution: A Bachelor’s Degree in Computer Science or IT Engineering may be substituted for exactly 4 years of experience (requiring 8 years of hands-on experience alongside the degree).
• Technical Tool Proficiency: Highly proficient in deploying, configuring, and modifying a diverse toolkit of industry-standard vulnerability scanners, exploitation frameworks, and automated or manual penetration testing tools.
• System & Protocol Expertise: Advanced understanding of network protocols, complex enterprise architectures, operating system internals, and modern IT services.
• Regulatory Knowledge: Proven experience interpreting, applying, and auditing against federal security mandates and agency-specific regulations.

Compliance, Certifications & Clearance Requirements

• Mandatory Professional Certifications: Candidates must satisfy DoD 8570.01-M requirements by holding:
• IAT Level III or IAM Level III baseline certification. Certified Ethical Hacker ( CEH ). An active, recognized vendor certification in a major operating system (e.g., Linux/Unix or Windows environments).
• IAT Level III or IAM Level III baseline certification.
• Certified Ethical Hacker ( CEH ).
• An active, recognized vendor certification in a major operating system (e.g., Linux/Unix or Windows environments).

Pay Range

• $160,000-$235,000
• Please note that the listed salary range for this position at M2 Technology Group is intended as a helpful guide, not a fixed guarantee. We strive to build offers that are equitable and competitive by looking at a variety of factors. Your final compensation will be tailored based on your individual experience, educational background, specialized skills, and the specific demands of the role.

Personal Time Off & Holidays

Health Care, Dental & Vision

401k (Nothing but the best here!)

Training & Education Reimbursement

Charity Donation Match

Pet Adoption

Referral Bonus & Company Events

Other Perks

• Swag Drops!, Flexible work schedule, Employee Appreciation Awards, Work Anniversary Gifts, Newborn Gifts

Ready to join our team?