Senior Penetration Tester (part-time)

INFORMATION SYSTEMS SOLUTIONS, INC•Charleston, SC

About The Position

Information Systems Solutions, Inc. (ISS) is seeking an experienced Senior Penetration Tester to join our Security Control Assessment (SCA) team in support of the National Science Foundation (NSF) Office of Polar Programs (OPP) and the United States Antarctic Program. In this role, you will lead advanced security testing and risk assessment activities across enterprise systems, infrastructure, and cloud environments. You will evaluate security controls against NIST standards, simulate real-world attack scenarios, and provide actionable risk guidance to technical teams and program leadership.

Requirements

Clearance Level Secret
One of the following: · Security+ CE · GIAC Security Essentials Certification (GSEC) · Security Certified Network Professional (SCNP) · System Security Certified Practitioner (SSCP)
5+ years of hands-on penetration testing or offensive security experience
Strong understanding of networking, operating systems, and application security
Extensive experience with tools such as Burp Suite, Metasploit, Nmap, Nessus, and custom tooling
Proficiency in scripting or programming (Python, Bash, PowerShell, JavaScript, etc.)
Deep knowledge of OWASP Top 10, common attack vectors, and exploitation techniques
Proven ability to write high-quality security reports and communicate risk effectively
Knowledge of cybersecurity tools

Nice To Haves

Offensive security certifications (OSCP, OSCE, CRTO, GPEN, etc.)
Experience with CI/CD and DevSecOps environments

Responsibilities

Assessment of security policies, procedures and processes against NIST standards.
Review of System Security Plans to report on compliance throughout the organization.
Provide Quarterly Reports of system security metrics.
Collaborate with other SCA Team Members to assess the Confidentiality, Integrity and Availability of systems
Advise Program Management on risk levels and security posture
Recognize possible security violations and takes appropriate action to report the incident, as required.
Ensure cybersecurity security requirements are appropriately identified in system environment operation procedures and collect and maintain data needed to meet system IA reporting requirements.
Evaluate system POA&Ms, tracking milestones
Prepare Risk Assessment Reports related to Pen Testing Activities
Conduct Red Team, Purple Team activities using government approved toolsets