Lead AI-Driven Penetration Testing Engineer

McKesson; United States; Hybrid; USD 122,000 - 163,000; Full time

Job summary

McKesson in the United States is seeking a Lead Penetration Testing Engineer to scale the CART program and strengthen the security of our enterprise application ecosystem. This role combines hands-on testing with technical leadership to shape offensive security across large portfolios, including AI-enabled testing and cloud security assessments.

You will partner with engineering, product, cloud, and security teams to identify complex attack paths, validate threats, and drive remediation, while

Qualifications

• Experience leading the design, implementation, and scaling of security testing programs.
• Ability to define operating models, governance, onboarding, testing cadence, and remediation workflows.
• Knowledge of autonomous and AI-assisted offensive security technologies and guardrails.

Responsibilities

• Lead the design, implementation, and scaling of McKesson’s Continuous Adversarial Testing program across large application portfolios.
• Develop the CART operating model, including service definition, governance, intake, application prioritization, onboarding, testing cadence, validation, reporting, escalation, and remediation workflows.
• Establish roles and responsibilities, decision authorities, guardrails, and controls for the safe use of autonomous and AI-assisted offensive security technologies.
• Define application eligibility, readiness, and prioritization criteria based on business criticality, exposure, data sensitivity, architecture, authentication requirements, and regulatory obligations.
• Develop repeatable onboarding processes covering application context, test accounts, authentication, authorization roles, test data, rate limits, WAF coordination, exclusions, maintenance windows, and emergency stop procedures.
• Define testing standards and methodologies for web applications, APIs, cloud-native applications, and modern application architectures.
• Establish human-in-the-loop processes for reviewing, reproducing, validating, prioritizing, and communicating findings generated by autonomous testing platforms.
• Lead the execution of continuous AI assisted penetration tests across high-priority enterprise web applications, including application onboarding, test orchestration, execution oversight, findings validation, and remediation coordination.
• Define quality standards for evidence, reproducibility, severity, exploitability, business impact, false-positive disposition, and finding acceptance.
• Design integrations between CART platforms and vulnerability management, engineering, reporting, and remediation workflows.
• Establish service metrics, key risk indicators, and executive reporting for application coverage, onboarding progress, testing frequency, finding quality, validated risk, remediation performance, retest outcomes, and program effectiveness.
• Build mechanisms for measuring false-positive rates, duplicate findings, testing completeness, platform utilization, and actionable vulnerability yield.
• Evaluate emerging autonomous security testing capabilities and recommend changes to CART strategy, tooling, and service delivery.
• Create program documentation, playbooks, runbooks, technical standards, training materials, and stakeholder communications.
• Provide technical leadership, mentoring, and strategic guidance while influencing enterprise security roadmaps, offensive security strategy, and architecture decisions.

Job description

McKesson in the United States is seeking a Lead Penetration Testing Engineer to scale the CART program and strengthen the security of our enterprise application ecosystem. This role combines hands-on testing with technical leadership to shape offensive security across large portfolios, including AI-enabled testing and cloud security assessments.

You will partner with engineering, product, cloud, and security teams to identify complex attack paths, validate threats, and drive remediation, while