Application Security Penetration Engineer

Description

The company is a global bank with about 200 million customer accounts, operating in more than 160 countries and jurisdictions. It serves consumers, corporations, governments and institutions through consumer banking and credit, corporate and investment banking, securities brokerage, transaction services and wealth management.

You would join the Offensive Security team within Operations & Technology, in the Information Security job family. The team tests the bank's most critical applications and researches how AI and LLM tooling can make penetration testing more effective.

The role suits an experienced penetration tester who wants to grow an offensive security career, or a software developer or engineer who wants to move into cybersecurity.

Responsibilities

• Manually assess web applications, mobile apps, thick clients, APIs, microservices and generative AI or LLM systems for known and zero-day vulnerabilities.
• Validate findings and exploit them safely, building proof-of-concept code and exploit scenarios that show how exploitable a weakness is and what damage it could do.
• Research and apply LLM-based testing methods to find deeply embedded, non-obvious flaws that automated and manual testing miss.
• Look for multi-step business logic abuse, cryptographic weaknesses and complex privilege escalation paths.
• Test applications, infrastructure or both, including pentests of the firm's top-tier critical applications.
• Write standard assessment reports covering reproduction steps, attack chains and risk ratings.
• Explain results to technical and non-technical audiences, including developers, architects and ML engineers, covering root causes and business risk.
• Recommend a defense-in-depth approach to business stakeholders, along with mitigating controls, code-level fixes and AI safety guardrails that close the gaps.
• Track new offensive techniques and take part in threat modeling and adversarial testing across traditional and AI-driven stacks.
• Research ways to automate pentesting, including with AI and LLM tooling.
• Perform other job-related duties as required.

Requirements

• One to three years of hands-on experience in penetration testing, application security assessment or software development, ideally in an enterprise environment.
• Hands-on use of dynamic, proxy or network testing tools such as Burp Suite Proxy, AppScan, WebInspect, Nessus, NMAP or OWASP ZAP.
• Hands-on use of static analysis and software composition tools such as Checkmarx, BlackDuck, SonarQube or Snyk.
• Strong grounding in enterprise programming and scripting languages such as Python, Java,.NET/C, C/C++, Ruby and/or NodeJS.
• Familiarity with web and application frameworks such as Spring, AngularJS, React, Struts, ASP.NET Core or AI orchestration libraries.
• Deep knowledge of application architectures and enterprise infrastructure, including databases, middleware, web servers and cloud platforms (GCP, AWS, Azure) running microservices and containerized workloads.
• Deep knowledge of OWASP Top 10 and CWE/SANS Top 25.
• Working familiarity with OWASP Top 10 for LLMs, MITRE ATLAS and NIST AI RMF.
• Exposure to AI security or adversarial testing tools such as Garak, PyRIT, Counterfit or the Adversarial Robustness Toolbox (ART) is advantageous.
• A bachelor's degree in Computer Science, Cybersecurity, Information Technology or a related discipline. Equivalent professional or hands-on experience may be considered instead.
• You must hold, or be willing to obtain, an industry-accredited security certification such as OSCP, OSWE, GWAPT, GWEB, GPEN, GXPN, GMOB, CISSP, CEH, CompTIA Security+ or CySA+.

Conditions

Full-time position based in Irving, Texas, United States.

Primary location full-time salary range is $96,400.00 to $144,600.00.

The company uses automated processing, including AI, to match candidates' skills to roles, and to suggest other suitable roles if you consent. People make all hiring decisions, and no automatic decision-making is used.

Illinois residents have specific AI notice and rights.

The company is an equal opportunity employer; its EEO policy statement and Know Your Rights poster are available online.

Benefits

• Discretionary and formulaic incentive and retention awards for eligible employees, in addition to salary.
• Medical, dental and vision coverage.
• 401(k) plan.
• Life, accident and disability insurance.
• Wellness programs.
• Paid vacation, sick leave and paid holidays.
• Offerings may vary by jurisdiction, job level and date of hire; full details are on the company's benefits site.