Principal Penetration Tester

Trespass Security LLC; Northern (KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Trespass Security LLC is seeking a senior security testing leader to drive complex web application, API, network, and cloud penetration engagements. You will stay hands-on while supervising others, setting practices, and ensuring findings are accurate, actionable, and defensible.

The role is full-time and fully remote from any eligible US location, requiring overlap with core US business hours and adherence to written authorization and engagement rules.

Qualifications

• Principal or lead-level experience owning penetration tests and reviewing others.
• Deep capability in web application and API testing across network and cloud surfaces.
• Ability to validate complex findings and distinguish impact from speculation.
• Experience in final technical-review decisions and method exceptions.
• Strong customer communication under scope and safety constraints.

Responsibilities

• Lead complex penetration tests within written authorization and ROE.
• Review difficult findings, guide scope and safety decisions.
• Coach practitioners and improve repeatable methods.
• Ensure evidence, planning, and reporting standards are robust.

Skills

Web application testing

API testing

Network security

Cloud security

Technical leadership

Education

Security-related degrees/certifications welcome but not required

Job description

Set the technical standard for authorized assessments, lead difficult decisions, and make sure every reported finding is accurate, useful, and defensible.

US remote Full-time W-2 Technical leadership Open until filled

The role

You will lead complex web application, API, network, and cloud penetration tests while establishing consistent methods for planning, evidence, validation, reporting, and technical review.

You will remain hands-on. You will also review difficult findings, help resolve scope and safety questions, coach other practitioners, and improve how Trespass turns authorized testing into clear customer decisions.

Lead difficult assessments

Plan and execute technically complex work within written authorization, Rules of Engagement, restrictions, and stop conditions.

Set the quality bar

Define practical testing and evidence standards, review findings, challenge unsupported conclusions, and ensure reports state impact and limitations accurately.

Guide scope and safety

Provide senior technical input when targets, attack paths, provider policies, data handling, or operational risk require careful decisions.

Develop the practice

Coach practitioners, improve repeatable methods, evaluate tools without becoming tool-dependent, and strengthen report and retest consistency.

What you will do

Combine deep testing with technical leadership.

What we are looking for

Judgment, depth, and a record of technical ownership.

• Principal or lead-level experience owning penetration tests and reviewing the work of other experienced practitioners.
• Deep capability in web application and API testing, with practical experience across network and cloud attack surfaces.
• Ability to validate complex findings, reason about attack paths, and distinguish demonstrated impact from speculation.
• Experience making final technical-review decisions, resolving disputed findings, and approving documented methodology exceptions.
• Strong customer communication and technical decision-making under scope and safety constraints.
• Experience improving assessment methodology, evidence quality, peer review, or practitioner development.
• Relevant degrees and security certifications are welcome but are not required.

What success looks like

The technical standard is clear and consistently applied.

• Practitioners know what evidence is required and when a finding is ready for reporting.
• Complex scope, safety, and technical-review questions reach clear, documented decisions.
• Reports distinguish demonstrated impact, limitations, and remediation direction without exaggeration.
• Testing methods improve as engagements reveal recurring gaps or better approaches.

Employment, location, and authorization.

Employment and location

This is full-time W-2 employment and is fully remote from an eligible location in the United States. Regular overlap with core US business hours is required. No routine travel is expected.

Work authorization

Applicants must be currently authorized to work in the United States. Trespass Security is not able to provide employment-based immigration sponsorship for this role.

Employment is contingent on completion of a job-related background check conducted in accordance with applicable law. Applicants who need a reasonable accommodation may email [e-mail] .

Equal opportunity

Trespass Security provides equal employment opportunities without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, disability, genetic information, veteran status, or any other status protected by applicable law.