Remote Lead Penetration Test Engineer-Cloud & App Security

S&P Global, Inc.; New Jersey; Hybrid; USD 135,000 - 200,000; Full time

Benefits offered by this job

Health & Wellness

Flexible Downtime

Continuous Learning

Invest in Your Future

Family Friendly Perks

Beyond the Basics

Job summary

S&P Global is seeking a Lead Penetration Test Engineer to drive offensive security across web, cloud, and infrastructure. You will conduct penetration tests, re-testing, vulnerability assessments, and threat modeling, delivering clear remediation guidance.

The role requires 8+ years in information security, hands-on expertise with Burp Suite, Nessus, Metasploit, Nmap, and scripting in Bash, Python, or PowerShell. A relevant OSCP/GPEN or similar cert is expected, with ability to brief executives.

Qualifications

• 8+ years in information security with focus on pentesting and vulnerability management.
• Experience with DAST, SAST, SCA and CI/CD integration.
• Strong scripting or programming skills in Bash, Python, Go, PowerShell, or JavaScript.

Responsibilities

• Conduct penetration testing of web apps, infrastructure, and cloud environments using manual and automated techniques.
• Develop custom tools and CI/CD integrated security testing
• Lead threat assessments, attack simulations, and risk-based remediation planning.
• Communicate findings clearly to technical and non-technical stakeholders.

Skills

Penetration testing

Scripting

Reporting to execs

Cloud security

Offensive security

Education

Bachelor's degree in CS/IS or related field

Tools

Burp Suite

Nessus

Metasploit

Nmap

Job description

S&P Global is seeking a Lead Penetration Test Engineer to drive offensive security across web, cloud, and infrastructure. You will conduct penetration tests, re-testing, vulnerability assessments, and threat modeling, delivering clear remediation guidance.

The role requires 8+ years in information security, hands-on expertise with Burp Suite, Nessus, Metasploit, Nmap, and scripting in Bash, Python, or PowerShell. A relevant OSCP/GPEN or similar cert is expected, with ability to brief executives.