{"id":2839934,"url":"https://alion.io/job/caci-international-senior-attack-surface-testing-sme","title":"Senior Attack Surface Testing SME","company":{"id":58481,"name":"CACI International","domain":"caci.com","url":"https://alion.io/company/caci-international","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"D","score":43,"open_postings":832,"ghost_share":0.722,"stale_share":0.01,"repost_share":0.871,"time_to_fill_p50_days":46,"computed_at":"2026-10-22T06:10:10Z"}},"role":"DevOps","role_family":"DevOps","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":90300,"max":189600,"currency":"USD","period":"year","gross":null,"usd_annual":189600},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"BGP","optional":false},{"name":"CI/CD","optional":false},{"name":"DNS","optional":false},{"name":"EPSS","optional":false},{"name":"KEV","optional":false},{"name":"PKI","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-09-14T00:00:00Z","employer_posted_date":"2026-09-14","last_verified_at":"2026-10-22T03:44:55Z","board_verified":true,"closed_at":null,"days_open":38,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":38},"description":"Job Title: Senior Attack Surface Testing SMEJob Category: Information TechnologyTime Type: Full timeMinimum Clearance Required to Start: Public TrustEmployee Type: RegularPercentage of Travel Required: Up to 10%Type of Travel: Continental US* * *The Opportunity:\nCACI is seeking a Senior Attack Surface Testing subject-matter expert to lead assigned continuous-assessment operations for federal cyber assets. This SME designs safe enumeration and validation approaches, directs junior engineers, adjudicates high-risk findings, and ensures rapid reporting and remediation guidance. This position works with the VM-ASE Technical Lead, customer process owners, Cloud/DevOps specialists, and AI-assisted analysis staff to deliver a repeatable, high-confidence assessment service.\nThis position will provide continuous technical assessment support for full-time, proactive testing of externally and internally visible federal cyber assets. This expands federal visibility by conducting continual assessments of .gov domains, subdomains, and internet-facing assets to uncover unknown exposures, validate vulnerabilities, and provide agencies with actionable remediation guidance. This role supports the Continuous Diagnostics and Mitigation (CDM) Program’s mission to safeguard and secure cyberspace in an environment where the threat of cyber-attack is continuously growing and evolving and is responsible for enhancing the security, resilience, and reliability of the Nation’s cyber and communications infrastructure. The CDM Program defends the United States (U.S.) Federal Information Technology (IT) networks from cybersecurity threats by providing continuous monitoring sensors (tools), diagnosis, mitigation tools, and associated services to strengthen the security posture of Government networks.\nResponsibilities:\nLead continuous attack-surface enumeration, vulnerability discovery, controlled validation, change monitoring, triage, reporting, and remediation-support activities.\nDesign scan architecture, asset-attribution logic, rate limits, credential and API handling, validation procedures, and deconfliction safeguards for large-scale production assessment.\nDirect and mentor junior engineers; review findings, evidence, false-positive determinations, attack paths, severity, and remediation recommendations.\nPrioritize risk using exposure, exploitability, CISA KEV, EPSS, asset criticality, compensating controls, and mission impact rather than scanner severity alone.\nLead rapid analysis of newly exposed or high-risk assets and coordinate urgent notifications, customer clarification, and closure validation.\nDefine requirements for automation, data normalization, dashboards, AI-assisted triage, and integrations with customer tools and authoritative repositories.\nProduce and technically approve recurring reports, trend analyses, high-risk findings, playbooks, standard operating procedures, and customer briefings.\nQualifications:\nRequired:\nU.S. citizenship is required.\nThe selected candidate must meet eligibility requirements for access to sensitive information and be able to obtain a Public Trust fitness determination (High Risk).\nAbility to work in customer-provided remote environments, use customer-approved tools, and comply with rules of engagement, data-handling requirements, evidence controls, deconfliction procedures, and stop-work criteria.\nFive or more years of attack-surface management, vulnerability assessment, external reconnaissance, penetration testing, or exposure-management experience, including leadership of continuous or large-scale assessment work.\nDeep knowledge of DNS, TLS/PKI, HTTP/S, TCP/IP, routing, service fingerprinting, cloud-hosting patterns, asset attribution, scanner behavior, and manual vulnerability validation.\nExperience designing safe high-volume scanning and enumeration workflows with rate control, scope enforcement, evidence capture, false-positive adjudication, and operational deconfliction.\nStrong automation and integration skills using Python, Go, Bash, APIs, structured data, source control, and repeatable pipelines.\nDemonstrated ability to lead technical staff, make defensible risk decisions, write high-quality reports, and brief technical and senior stakeholders.\nOne or more relevant certifications such as OSCP, OSEP/OSCE, GPEN, GXPN, CISSP, GCIH, cloud-security certifications, or equivalent.\nDesired:\nEight or more years in attack-surface, offensive-security, vulnerability-management, or internet-measurement roles.\nExperience with federal .gov attack-surface monitoring, coordinated vulnerability disclosure, critical infrastructure, or high-value assets.\nAdvanced use of certificate-transparency, passive DNS, BGP/ASN, internet telemetry, cloud inventories, and exposure-management data sources.\nExperience integrating findings with SIEM/data-lake, ticketing, visualization, or threat-intelligence platforms.\nAWS, Terraform, Ansible, CI/CD, container, or IaC-security experience sufficient to coordinate closely with platform specialists.\n-What You Can Expect:\nA culture of integrity.\nAt CACI, we place character and innovation at the center of everything we do. As a valued team member, you’ll be part of a high-performing group dedicated to our customer’s missions and driven by a higher purpose - to ensure the safety of our nation.\nAn environment of trust.\nCACI values the unique contributions that every employee brings to our company and our customers - every day. You’ll have the autonomy to take the time you need through a unique flexible time off benefit and have access to robust learning resources to make your ambitions a reality.\nA focus on continuous growth.\nTogether, we will advance our nation's most critical missions, build on our lengthy track record of business success, and find opportunities to break new ground - in your career and in our legacy.\nPay Range:\nThere are a host of factors that can influence final salary including, but not limited to, geographic location, Federal Government contract labor categories and contract wage rates, relevant prior work experience, specific skills and competencies, education, and certifications. Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives. We offer competitive compensation, benefits and learning and development opportunities. Our broad and competitive mix of benefits options is designed to support and protect employees and their families. At CACI, you will receive comprehensive benefits such as; healthcare, wellness, financial, retirement, family support, continuing education, and time off benefits.\nSince this position can be worked in more than one location, the range shown is the national average for the position.\nThe proposed salary range for this position is:\n$90,300-$189,600CACI is an Equal Opportunity Employer.All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, age, national origin, disability, status as a protected veteran, or any other protected characteristic.","description_format":"text","description_chars":7097,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Flexible time off"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Data & Analytics","Military","National Security"],"lifecycle":[{"event":"open","at":"2026-10-19T08:39:13Z"}],"visa":[],"liveness":{"score":46,"band":"ok","label":"Likely open","p_open":1,"p_active":0.61,"p_room":0.75,"age_days":38,"expected_fill_days":46,"reasons":["conf:2","stale_co","urgency","velocity","win:late","comp:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":189600,"is_top_pay":true},"html_url":"https://alion.io/job/caci-international-senior-attack-surface-testing-sme","json_url":"https://alion.io/job/caci-international-senior-attack-surface-testing-sme.json","meta":{"generated_at":"2026-10-22T20:50:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5055,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58481},"rest":"https://alion.io/mcp/rest/get_company?id=58481"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcaci-international-senior-attack-surface-testing-sme"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcaci-international-senior-attack-surface-testing-sme"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcaci-international-senior-attack-surface-testing-sme"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/caci-international-senior-attack-surface-testing-sme\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcaci-international-senior-attack-surface-testing-sme"}]}