Senior Penetration Testing Lead

Everforth ECS is seeking a Senior Penetration Testing Lead to work in the National Capital Region covering the Pentagon, Falls Church, and Fairfax. Please Note: This position is contingent upon contract award.

The War Data Platform (WDP) is a key initiative within the U.S. Department of War's (DoW) AI-First strategy introduced in early 2026. The WDP separates business and financial data from operational warfighting data, aiming to accelerate the deployment of artificial intelligence (AI) on the battlefield. The WDP extends to Unclassified, Secret, and Top Secret environments, and supports collaboration between Combatant Commands, Joint Staff directorates, Senior Executive Service leaders, and operational analysts.

The Senior Penetration Testing Lead serves as the principal offensive security authority for WDP, planning and executing controlled adversarial assessments across NIPRNet, SIPRNet, and JWICS environments to validate control effectiveness, identify exploitable attack paths, and directly inform Risk Management Framework authorization decisions across WDP's multi-enclave architecture.

This is a senior technical leadership role demanding deep expertise in adversary emulation, red team operations, and government authorization processes, with direct responsibility for protecting mission-critical AI and analytics capabilities supporting warfighter decision-making at the highest levels of DoW leadership.

• Leads offensive security operations supporting Department of War mission systems across unclassified and classified networks.
• Plans, coordinates, and executes controlled penetration testing engagements against network infrastructure, web applications, cloud environments, and mission systems to identify exploitable attack paths beyond automated scanning capabilities.
• Develops testing strategies, rules of engagement, and assessment methodologies aligned with DoW cybersecurity policy and authorization objectives.
• Conducts advanced adversary emulation activities including lateral movement analysis, privilege escalation, command-and-control simulation, and post-exploitation impact assessment while maintaining operational safety and system availability.
• Coordinates testing activities with system owners, ISSOs, network defenders, and security operations teams to deconflict operations and support rapid response if anomalous behavior is detected.
• Produces comprehensive penetration test reports detailing attack vectors, exploitation techniques, evidence artifacts, and prioritized remediation recommendations.
• Supports red team exercises validating detection, response, and recovery capabilities across defensive teams and security tooling.
• Performs remediation verification and retesting to confirm corrective actions effectively mitigate identified risks.
• Maintains testing documentation, evidence repositories, and executive summaries supporting Risk Management Framework activities, authorization decisions, and leadership briefings.
• Delivers actionable insights that strengthen defensive posture, validate control effectiveness, and reinforce program values of resilience, accountability, mission assurance, and proactive cyber defense.
• Performs other duties as assigned.

• Current Secret security clearance.
• 10–12 years of experience in penetration testing, offensive security, red team operations, or a closely related cybersecurity discipline, with demonstrated senior-level ownership of full-lifecycle penetration test engagements across complex federal, DoW, or enterprise network and cloud environments.
• IAM Level I certification from an approved credential, including CompTIA Security+ CE, ISC² CAP, ISC² SSCP, or GIAC GSLC.
• Advanced offensive security certification such as Offensive Security Certified Professional (OSCP), Offensive Security Experienced Penetration Tester (OSEP), GIAC Penetration Tester (GPEN), GIAC Exploit Researcher and Advanced Penetration Tester (GXPN), or an equivalent credential demonstrating mastery of adversary emulation, exploitation techniques, and structured penetration testing methodology.
• Proven experience supporting DoW or federal Risk Management Framework processes, including preparation and maintenance of penetration testing plans, rules of engagement, Body-of-Evidence artifacts, and remediation findings packages in support of Authority to Operate decisions and continuous monitoring obligations under NIST 800-53.
• Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.
• Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management).