Penetration Testing Engineer

Description

The company is a Fortune 10 business in healthcare, known for insights, products and services that make quality care easier to access and more affordable.

The Pentest team is hiring a Penetration Testing Engineer to help run and grow the Continuous Adversarial Testing (CART) program and tighten security across the enterprise application estate.

You will work on AI-enabled security testing, web application pentests, cloud security reviews, vulnerability validation and adversarial testing across a large application portfolio.

You will work with a pentest lead and with engineering, product, cloud and security colleagues to find complex attack paths, confirm threats and push fixes that lower business risk.

This is hands-on work. You will help build a new security program while doing advanced testing, checking AI-generated findings, solving operational problems and shaping the long-term offensive security direction.

Responsibilities

• Help implement the CART program across large application portfolios, working alongside a Lead Pentest Engineer.
• Help define the first version of the CART operating model.
• Run and improve repeatable onboarding that covers app context, test accounts, authentication, authorization roles, test data, rate limits, WAF coordination, exclusions, maintenance windows and emergency stops.
• Review, reproduce, validate, rank and report findings from autonomous testing platforms, with a human checking each result.
• Support continuous AI-assisted pentests on high-priority enterprise web apps, including onboarding, test orchestration, oversight, finding validation and remediation follow-up.
• Connect CART platforms to vulnerability management, engineering, reporting and remediation workflows.
• Run AI-enabled assessments of web apps, APIs and cloud environments.
• Carry out pentests, adversarial assessments and vulnerability validation against in-house and third-party applications.
• Assess emerging autonomous testing tools and recommend changes to CART strategy, tooling and delivery.
• Write and update playbooks, runbooks, technical standards and training materials.
• Use automation and AI-assisted tools to widen test coverage and speed up assessments.
• Find and validate complex attack paths, such as authentication weaknesses, authorization flaws, business logic bugs and multi-stage exploits.
• Assess REST APIs, GraphQL APIs, cloud-native designs and modern authentication technologies.
• Explain findings to engineering teams, help them prioritise fixes and confirm fixes through retesting.
• Build and maintain test methods, automation workflows and assessment procedures.
• Support incident investigations, threat modelling and continuous security improvement work.

Requirements

• Have 4+ years in cybersecurity, application security, penetration testing, offensive security or a related field.
• Hold a bachelor's degree or an equivalent mix of education and experience.
• Have tested web applications and APIs for security flaws.
• Can judge whether a vulnerability is exploitable and separate real issues from false positives.
• Have assessed enterprise apps built on REST APIs, GraphQL APIs, authentication systems and cloud-native technology.
• Understand security concepts on AWS, Azure or Google Cloud Platform (GCP).
• Have written up technical findings and explained remediation steps to engineers.
• Have hands-on use of Burp Suite Professional, Nuclei, Nmap, Metasploit, Postman and Kali Linux tools.
• Preferred: experience with AI-assisted security tools and security automation platforms.
• Preferred: experience running or scaling continuous security testing, attack simulation, breach and attack simulation or automated offensive security.
• Preferred: experience evaluating and triaging findings from automated or AI-assisted testing platforms.
• Preferred: experience assessing AI-enabled applications, agent-based systems, LLM integrations or AI security risks.
• Preferred: familiarity with DevSecOps, CI/CD security controls and secure development practice.
• Preferred: knowledge of the OWASP Top 10, the API Security Top 10, threat modelling and secure design principles.
• Preferred: experience with red team, adversarial simulation or attack path validation work.
• Preferred: knowledge of cloud security architecture and containerized environments.
• Preferred: experience assessing AWS, Azure and GCP environments.
• Preferred: experience writing custom security test scripts and automation workflows.
• Preferred: experience developing proof-of-concept exploits and adversary emulation scenarios.
• Preferred: familiarity with security control validation and compliance frameworks.
• Preferred: experience mentoring engineers and improving security program maturity.
• Preferred: experience in regulated industries such as healthcare, finance or similar environments.
• Preferred: relevant certifications such as OSCP, OSWE, OSWA, OSAI, HTB CWES, HTB CWEE, OSEP, GPEN, GWAPT or equivalent.

Conditions

Travel may be required, driven by the needs of the business.

Hybrid working, with two days a week in the office.

The base pay range is $103,900 - $173,100.

Individual pay reflects performance, experience and skills, equity, periodic market reviews and geography, and always follows applicable regulations.

Equal opportunity employer.

Benefits

• Competitive compensation package under the Total Rewards program.
• Possible annual bonus or long-term incentive opportunities.