Cyber Security Engineer (Penetration Tester)

As a Cyber Security Engineer (Penetration Tester) at CACI, you will be responsible for conducting thorough vulnerability assessments on diverse technologies including web applications and network devices. Your role includes utilizing advanced penetration testing tools to identify security vulnerabilities and recommend effective mitigation strategies. You'll also participate in R&D efforts to explore emerging technologies, ensuring that you stay up-to-date in this rapidly evolving field.

To qualify for the Cyber Security Engineer (Penetration Tester) role at CACI, you need an active DoD Secret clearance and IAT Level II certification, such as Security+ or its equivalent. Ideal candidates should possess over five years of experience in offensive security, with a solid understanding of Linux and Windows internals. Additional skills in network protocols and monitoring tools like Wireshark and Burp Suite are key to success in this position.

The Cyber Security Engineer (Penetration Tester) position at CACI is strictly on-site at Aberdeen Proving Ground, MD. Telework options are not available for this role because your contributions and collaboration with the team are essential for success in our security assessments.

At CACI, we pride ourselves on fostering a culture of continuous growth and development. As a Cyber Security Engineer (Penetration Tester), you will have access to robust learning resources, training programs, and the opportunity to engage in innovative projects. We encourage employees to pursue additional certifications and provide a supportive environment to advance their careers while contributing to critical national missions.

The salary range for a Cyber Security Engineer (Penetration Tester) at CACI is between $75,200 and $158,100 USD. This range is influenced by various factors including geographic location, relevant work experience, specific skills, education, and certifications, ensuring a competitive compensation package that recognizes your value.

When asked about performing a vulnerability assessment, explain your methodology by outlining the steps you take, such as identifying assets, scanning for vulnerabilities, analyzing results, and prioritizing vulnerabilities based on risk. Mention the tools you use, such as Burp Suite or Wireshark, to support your answer.

Discuss the phases of the penetration testing lifecycle, typically including planning, discovery, exploitation, reporting, and remediation. Provide examples of techniques or tools used in each phase, highlighting your practical experience with these processes.

Share your preferred penetration testing tools such as Metasploit, Burp Suite, and Nmap, explaining what features make them effective. Discuss your experience with these tools in past projects and how they helped you identify vulnerabilities.

Mention resources like cybersecurity blogs, forums, and industry conferences. Additionally, you could discuss how you follow key security platforms that provide updates on vulnerabilities, exploits, and new technologies that impact the cybersecurity landscape.

Elaborate on your familiarity with various network protocols, specifying your experience using tools like Wireshark for analyzing network traffic. Provide an example of a past situation where you identified and resolved security vulnerabilities through network analysis.

Explain your incident response strategy, which might include identification, containment, eradication, recovery, and lessons learned. Use real-world examples to demonstrate your ability to effectively respond to security incidents, emphasizing collaboration with team members.

Share a specific example of a vulnerability you discovered, detail the steps you took to document it and communicate with relevant stakeholders, and any mitigation strategies you recommended. Highlight your problem-solving skills and how you improved security posture as a result.

Mention key cybersecurity frameworks such as NIST, ISO 27001, or OWASP, and explain how you incorporate these standards into your assessments and practices to ensure compliance and industry best practices. Provide examples of successfully applying these frameworks in your work.

Discuss your ability to translate technical information into layman's terms. Provide an example of how you've successfully conveyed complex cybersecurity concepts to clients or management, emphasizing your interpersonal skills and the importance of effective communication.

Describe the importance of ethical guidelines in penetration testing, such as obtaining proper authorization and adhering to a code of conduct. Discuss how you ensure ethical practices while performing assessments, including maintaining confidentiality and responsibly reporting findings.