Junior Penetration Tester

Science Applications International Corporation (SAIC) is seeking a Junior Penetration Tester to join our offensive security practice supporting a major state and local government customer. This is an excellent opportunity for an early-career security professional who wants to build hands-on experience while working on real-world engagements that matter. As a Junior Penetration Tester, you will focus primarily on web application and network penetration testing. Working alongside experienced testers, you will plan and execute assessments, identify vulnerabilities, validate findings, and document results in clear, actionable reports. You'll bring curiosity, persistence, and a strong desire to learn, and we'll give you the mentorship and room to grow your skills. This position reports to the Security Assessments Manager.

Responsibilities

- Assessment Delivery: Conduct penetration tests across a range of client environments, applying black box and white box methodologies for web, network, and mobile targets, aligned to NIST standards.
- Engagement Support: Manage your own assigned tasks and workload within engagements, from scoping support through final reporting, with guidance from senior testers and a consistent focus on quality.
- Reporting: Produce clear, well-structured technical reports that communicate findings, risk context, and actionable remediation guidance. Learn to translate complex technical details into terms that both technical teams and executive stakeholders can act on.
- Mobile Security: Contribute to iOS and Android application security assessments, with the opportunity to grow your mobile testing capabilities over time.
- Security Fundamentals: Apply your knowledge of security architectures, firewalls, network traffic, and access controls to identify and assess weaknesses across client environments.
- Tools and Techniques: Use COTS, GOTS, and custom tools to scan for, identify, and validate vulnerabilities. Help research and evaluate new tools, techniques, and technologies, and recommend improvements to the team.
- Client Communication: Develop your ability to present findings with confidence, whether walking a customer through a vulnerability chain or helping explain business risk to their leadership.
- Professional Development: Align your growth with the NICE Framework and build foundational skills in cybersecurity and digital forensics through mentorship, training, and hands-on practice.
- Team Contribution: Share what you learn with teammates, contribute to internal tooling and methodology improvements, and help close skill gaps across the practice.
- Continuous Learning: Stay current on emerging vulnerabilities, attack techniques, and industry developments, and bring that knowledge back to the team.

Required Education and Qualifications

- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field is preferred but not required. Equivalent hands-on experience, such as labs, CTFs, internships, or personal projects, may be considered in lieu of a degree.
- Candidates must be able to pass a CJIS Criminal Justice background investigation and maintain CJIS clearance throughout the term of employment.

Required Experience

- Foundational knowledge of cybersecurity concepts, including networking, operating systems, and common attack techniques.
- Working knowledge of the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10, including how to identify and exploit common vulnerabilities in lab or practical settings.
- Hands-on familiarity with standard web application testing & vuln scanning tools (e.g., Burp Suite, Tenable etc.).
- Basic understanding of network security concepts, including firewalls, network traffic, and access controls.
- Ability to write clear, organized technical documentation, with a willingness to incorporate feedback and improve report quality.
- Strong curiosity, problem-solving skills, and a drive to keep learning.
- One of the following certifications is strongly preferred: GWAPT & OSCP. Candidates holding or actively pursuing the above or PNPT, PenTest+, PJPT, eJPT, OSEP/OSWE/OSED, or GWEB will also be considered.

Preferred Experience

- Exposure to mobile application testing concepts and tools (e.g., Frida, Objection, MobSF, ADB), including any hands-on iOS or Android assessment experience.
- Familiarity with API security testing (REST, GraphQL, SOAP).
- Exposure to source code review as part of white box testing.
- Experience with CTFs, bug bounty programs, home labs, or platforms such as Hack The Box, TryHackMe, or PortSwigger Web Security Academy.
- Basic scripting skills (e.g., Python, Bash, PowerShell) to automate tasks.
- Introductory exposure to cloud security concepts, digital forensics, or reverse engineering.
- Experience presenting technical information to peers or stakeholders, or interest in building this skill.
- Ability to work collaboratively under the guidance of senior team members.