Mainframe and Web Application Security Senior Engineer - Senior Penetration Tester

Cybersecurity Jobs; Charlotte (NC); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401k plan

Vacation (10 days in first year)

Job summary

Cybersecurity Jobs is seeking an experienced security engineer for an onsite role in Charlotte, NC. The position focuses on enhancing testing coverage for z/OS and mainframe environments, partnering with teams to validate remediation and strengthen repeatable offensive testing practices.

The candidate will conduct black/grey box and breach testing, work across RACF/ACF2/Top Secret, and validate findings with clear remediation recommendations. PCI DSS and SOX considerations may apply.

Qualifications

• Bachelor’s degree or equivalent education and work experience.
• Minimum of 7 years in security engineering or related cybersecurity roles.
• Deep specialized knowledge of cybersecurity principles, theories, and concepts.

Responsibilities

• Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS, including USS and subsystems like RACF, ACF2, and Top Secret.
• Test core mainframe workloads and interfaces such as CICS, IMS, DB2, MQ, and JCL-based batch components (JES2, TSO/ISPF).
• Assess network-facing services including TN3270, FTP, Z/OS Connect, Rest APIs, and NJE.

Skills

Mainframe security

Threat modeling

Penetration testing

Security engineering

Technical writing

Education

Bachelor’s degree or equivalent

Tools

RACF

ACF2

Top Secret

z/OS

CICS

IMS

DB2

MQ

JCL

TSO/ISPF

REXX

Python

Job description

Onsite in Charlotte, NC with a compensation range of $140,000 to $180,000 annually. This role focuses on improving how security testing covers enterprise z/OS and mainframe environments, while partnering with teams to validate remediation and strengthen repeatable offensive testing practices.

Benefits

• Medical insurance
• Dental insurance
• Vision insurance
• Life insurance
• Disability insurance
• Accidental death and dismemberment
• Tax-preferred savings accounts
• 401k plan
• No less than 10 days of vacation during the first year of employment (prorated based on hire date and full-time/part-time status)
• 10 sick days (also prorated)
• Paid holidays
• Defined benefit pension plan (depending on position and division)
• Restricted stock units (depending on position and division)
• Deferred compensation plan (depending on position and division)

Benefits eligibility: All regular teammates working 20 hours or more per week are eligible for benefits, with specific benefits determined by the division.

Responsibilities

• Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS, including coverage across USS (Unix System Services) and security subsystems such as RACF, ACF2, and Top Secret.
• Test core mainframe workloads and interfaces including CICS, IMS, db2, MQ, plus batch processing components such as JCL and JES2, and TSO/ISPF.
• Assess network-facing services including TN3270, FTP, Z/OS Connect, Rest APIs, and NJE.
• Apply manual techniques and custom scripting using REXX, JCL, Assembler, and Python, along with offensive tooling to enumerate users and resources, map datasets, assess access to unprotected spool and job output, and exploit misconfigured CICS transactions and insecure interfaces.
• Evaluate exploitability and business impact, applying judgment to determine finding severity and risk.
• Document findings with clear reproduction steps, supporting evidence, impact statements, and practical remediation recommendations.
• Present and defend technical findings to application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders.
• Perform validation and retesting to confirm remediation and risk reduction, and maintain testing evidence to support audit, regulatory, and compliance requirements including PCI DSS and SOX.
• Partner with internal and external testing teams to improve mainframe testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes.
• Conduct peer reviews of penetration testing reports and provide technical guidance and mentorship to other security professionals.
• Maintain current knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats.

Requirements

• Bachelor’s degree or equivalent education, training, and work-related experience.
• Minimum of 7 years of experience in security engineering or related cybersecurity roles.
• Deep specialized knowledge of cybersecurity principles, theories, and concepts.
• Proven experience with software development lifecycle security practices.
• Deep knowledge of threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.

Preferred Qualifications

• Five or more years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience.
• Hands-on experience assessing mainframe environments, including z/OS and security components such as RACF, ACF2, or Top Secret.
• Knowledge of mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening.
• Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments.
• Strong technical writing and communication skills, including the ability to explain and defend technical findings to technical and non-technical audiences.
• Ability to independently manage multiple testing engagements, adjust approach as priorities and requirements evolve, and drive work to completion.
• Experience developing scripts, automation, or AI-enabled tooling that streamlines testing and improves repeatable process efficiency.
• Experience in banking, financial services, or another highly regulated industry.
• Relevant offensive security certifications such as OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials.

Technology Focus

• z/OS, USS, RACF, ACF2, Top Secret
• CICS, IMS, db2, MQ
• JCL, JES2, TSO/ISPF
• TN3270, FTP, Z/OS Connect, Rest APIs, NJE
• REXX, Assembler, Python
• PCI DSS, SOX
• OSCP, OSEP, OSWE, GPEN, GXPN