Lead Pen Test Engineer - Hybrid, Cloud & App Security

spgi; Princeton (NJ); Hybrid; USD 140,000 - 190,000; Full time

Job summary

SPGI is seeking a Lead Penetration Test Engineer to drive offensive security across web, cloud, and infrastructure. Hybrid role with on-site days at multiple US sites, including Princeton.

You will conduct penetration tests, re-tests, vulnerability assessments, and threat modeling, and you’ll lead attack simulations, craft clear remediation guidance, and brief executives on risk and security posture.

Qualifications

• 8+ years information security with focus on penetration testing, application security, and vulnerability management.
• Hands-on with penetration testing tools (Burp Suite, Nessus, Metasploit, Nmap) and methodologies (OWASP Top 10, MITRE ATT&CK, PTES).
• Expertise in identifying and exploiting common vulnerabilities (XSS, SQLi, IDOR).
• Strong scripting/programming skills (Bash, Python, PowerShell, JavaScript).
• Ability to translate findings into clear, actionable reports for teams and executives.

Responsibilities

• Lead penetration tests across web, infrastructure, and cloud environments.
• Develop scripts and methodologies to enhance testing within CI/CD pipelines.
• Perform DAST, SAST, and SCA assessments and coordinate remediation.
• Lead attack simulations and threat assessments with cross-functional teams.
• Communicate findings to technical and non-technical stakeholders and provide remediation guidance.

Skills

Penetration Testing

Vulnerability Assessments

Cloud Security

Scripting

CI/CD Security

Threat Modeling

Communication

OWASP Top 10

MITRE ATT&CK

Education

Bachelor's degree in CS/IS

Tools

Burp Suite

Nessus

Metasploit

Nmap

Job description

SPGI is seeking a Lead Penetration Test Engineer to drive offensive security across web, cloud, and infrastructure. Hybrid role with on-site days at multiple US sites, including Princeton.

You will conduct penetration tests, re-tests, vulnerability assessments, and threat modeling, and you’ll lead attack simulations, craft clear remediation guidance, and brief executives on risk and security posture.