Lead Penetration Tester

Description

The company is a large healthcare company rated Fortune 10, with products and services that help make quality care more accessible and affordable.

The Pentest Team is hiring a Lead Penetration Testing Engineer to scale the company's Continuous Adversarial Testing (CART) program and harden the security of its enterprise application estate.

This is a hands-on technical leadership role. You will build a new security program while doing advanced testing, checking AI-generated findings, solving operational problems, and setting the long-term direction of offensive security.

You will work with engineering, product, cloud, and security teams to find complex attack paths, confirm threats, and push fixes that lower business risk. The role also helps shape AI-assisted testing, automation, and modern offensive methods across the enterprise.

Responsibilities

• Lead the design, rollout, and growth of the CART program across large application portfolios.
• Build the CART operating model: service definition, governance, intake, prioritization, onboarding, test cadence, validation, reporting, escalation, and remediation.
• Set roles, decision rights, guardrails, and controls for safe use of autonomous and AI-assisted offensive tools.
• Define criteria for which applications are eligible, ready, and high priority, based on criticality, exposure, data sensitivity, architecture, authentication, and regulatory duties.
• Create repeatable onboarding covering app context, test accounts, auth and roles, test data, rate limits, WAF coordination, exclusions, maintenance windows, and emergency stops.
• Set testing standards and methods for web apps, APIs, cloud-native apps, and modern architectures.
• Design human-in-the-loop steps to review, reproduce, validate, rank, and report findings from autonomous platforms.
• Run continuous AI-assisted penetration tests on high-priority enterprise web apps, covering onboarding, orchestration, oversight, validation, and remediation follow-up.
• Set standards for evidence, reproducibility, severity, exploitability, business impact, false-positive handling, and acceptance of findings.
• Connect CART platforms with vulnerability management, engineering, reporting, and remediation workflows.
• Define service metrics, key risk indicators, and executive reports covering coverage, onboarding, test frequency, finding quality, validated risk, fix speed, retest results, and program effectiveness.
• Measure false-positive rates, duplicates, test completeness, platform use, and useful findings per test.
• Assess new autonomous testing tools and recommend changes to strategy, tooling, and delivery.
• Write program documents, playbooks, runbooks, technical standards, training, and stakeholder updates.
• Mentor staff, give technical direction, and shape security roadmaps, offensive strategy, and architecture decisions.

Requirements

• Experience running or scaling continuous security testing, attack simulation, breach and attack simulation, or automated offensive security.
• Experience setting up governance, onboarding, service-level objectives, metrics, reporting, and workflows for a security program.
• Experience validating and triaging findings from automated or AI-assisted testing platforms.
• Experience evaluating security tools and managing vendor and service provider relationships.
• Experience assessing AI-enabled apps, agent systems, LLM integrations, or AI security risks.
• Familiarity with DevSecOps, CI/CD security controls, and secure development practice.
• Knowledge of the OWASP Top 10, the API Security Top 10, threat modeling, and secure design principles.
• Experience in regulated industries such as healthcare or finance is preferred.
• Certifications such as OSCP, OSWE, OSWA, OSAI, HTB CWES, HTB CWEE, OSEP, GPEN, GWAPT, or equivalent are preferred.
• Knowledge of offensive automation frameworks and AI-assisted testing is preferred.
• Experience building proof-of-concept exploits and adversary emulation scenarios is preferred.

Conditions

Limited travel may be required based on business needs.

Hybrid or remote work may be available under company policy.

You will spend long periods at a computer and in virtual meetings.

You may be asked to support cybersecurity incident response outside standard business hours when needed.

Base pay range is $122,100 - $162,800.

Equal Opportunity Employer.

Benefits

• Pay depends on performance, experience and skills, equity, periodic market reviews, and location.
• Total compensation may also include an annual bonus or long-term incentives.
• Benefits are described on the company's benefits page.