Senior Cybersecurity Penetration Tester

11400 Information Systems; United States; On-site; USD 68,000 - 107,000; Full time

Benefits offered by this job

PEAK tuition coverage

Comprehensive benefits package

Job summary

Intermountain Healthcare Inc. is seeking a Cybersecurity Senior specialized in penetration testing to design, engineer, and assess key elements of the organization’s cybersecurity program.

You will conduct complex engagements across enterprise networks, applications, APIs, cloud, and identity platforms, using manual and automated techniques to identify exploitable weaknesses and develop actionable remediation guidance.

Qualifications

• Bachelor’s degree or equivalent in a related field or intermediate cybersecurity certification.
• Experience with offensive security, penetration testing, vulnerability assessments, or related cybersecurity disciplines.
• Experience using industry-standard penetration testing and security assessment tools.

Responsibilities

• Plan, scope, and independently execute complex penetration testing engagements across networks, applications, APIs, cloud environments, and identities.
• Perform advanced penetration testing using manual and automated techniques to identify vulnerabilities and attack paths.
• Test application and API security including authentication, authorization, session management, and input validation.
• Conduct network/infrastructure penetration testing with recon, exploitation, and post‑exploitation activities within authorized boundaries.
• Develop and maintain testing methodologies, playbooks, and standards for repeatable assessments.
• Produce clear, technical penetration testing reports with evidence, findings, risk, and remediation recommendations.

Skills

Penetration testing

Offensive security

Ethical hacking

Red team

Vulnerability assessments

Scripting

Communication

Education

Bachelor’s degree or equivalent

Cybersecurity certifications (SANS 500+, CISA, or CISM)

Tools

Penetration testing tools

Adversary simulation tools

Job description

Job Description

The Intermountain Cybersecurity Program is broken into four distinct functions: Governance Risk and Compliance, Cyber Solutions, Cyber Advisory and the Cyber Fusion Center. Cyber Caregivers within Intermountain will specialize in their specific area and function. The Cybersecurity‑Senior is responsible for designing, engineering, analyzing and/or assessing key elements of Intermountain’s cybersecurity program. Caregivers within this job code will support one of the following aspects of the cyber program: governance, risk and compliance activities, identity and access management, data, endpoint and application security, infrastructure and network security, cyber architecture and standards, reporting and analytics, project management and business liaising. Senior‑level professionals are experienced in all aspects of cybersecurity and/or IT systems. Typically designs and develops approaches that are implemented by others. Functions independently with minimal oversight and direction. May instruct and guide lower level technical professionals. The hiring manager is considering candidates with experience in offensive security, penetration testing, ethical hacking, red team operations, vulnerability assessments, or related cybersecurity disciplines. Ideal candidates will have experience using industry‑standard penetration testing and security assessment tools, conducting web application and network testing, identifying and validating vulnerabilities, and communicating findings through clear technical reports and stakeholder presentations. Experience with scripting, hardware or IoT security testing, social engineering assessments, recognized security certifications, and security‑cleared environments is a plus.

Essential Functions: Plans, scopes, and independently executes complex penetration testing engagements across enterprise networks, applications, APIs, cloud environments, identity platforms, and other technology environments. Performs advanced penetration testing using manual and automated techniques to identify vulnerabilities, configuration weaknesses, attack paths, and opportunities that could allow unauthorized access, privilege escalation, lateral movement, or compromise of sensitive systems and data. Conducts application and API security testing, including authentication, authorization, session management, input validation, business logic, and other security controls using established penetration testing methodologies and industry practices. Performs network and infrastructure penetration testing against internal and external environments, including reconnaissance, enumeration, exploitation, privilege escalation, lateral movement, and post‑exploitation activities within authorized engagement boundaries. Conducts adversary simulation, assumed‑breach exercises, and targeted security assessments to evaluate the effectiveness of preventive, detective, and responsive security controls against realistic attack techniques. Develops and maintains penetration testing methodologies, procedures, playbooks, testing standards, and repeatable approaches to ensure consistent and defensible security assessments. Researches emerging vulnerabilities, exploitation techniques, attacker tradecraft, and security technologies and applies relevant techniques to penetration testing activities. Develops and uses scripts, automation, and offensive security tooling to improve testing effectiveness, coverage, repeatability, and efficiency. Analyzes identified vulnerabilities to determine exploitability, attack paths, compensating controls, and potential business impact rather than relying solely on automated vulnerability severity ratings. Produces clear and technically accurate penetration testing reports documenting scope, methodology, evidence, findings, risk, exploitation results, and actionable remediation recommendations. Communicates technical findings and demonstrated attack scenarios to technical teams, cybersecurity leadership, application owners, infrastructure teams, and other stakeholders at an appropriate level of technical detail. Partners with application, infrastructure, cloud, identity, and cybersecurity teams to validate findings, provide remediation guidance, and perform retesting to confirm corrective actions are effective. Serves as a senior technical resource for penetration testing and offensive security activities, providing technical guidance, peer review, and support to other cybersecurity professionals. Reviews penetration testing evidence and findings for technical accuracy, reproducibility, appropriate risk characterization, and reporting quality. Provides technical guidance and mentoring to less experienced penetration testers and cybersecurity professionals and assists in developing offensive security capabilities across the team. Supports security incident response and threat‑driven investigations when advanced offensive security expertise, exploitation analysis, or attack‑path validation is required. Ensures penetration testing activities are properly authorized, scoped, documented, and conducted in accordance with organizational policies, rules of engagement, applicable regulatory requirements, and established testing procedures. Effectively prioritizes and executes multiple penetration testing engagements and technical assignments while operating independently with minimal oversight.

Qualifications

• Minimum: Bachelor’s degree through an accredited institution or Intermediate level cybersecurity certification, such as SANS 500+ Series, CISA, or CISM 5-8 years of related work experience.
• Experienced skills in cybersecurity technologies, systems and processes.
• Advanced troubleshooting skills.
• Experienced skill in analysis, attention to detail, problem resolution, judgment, and decision‑making.
• Experienced skill in communication, presentation, and collaboration.
• Preferred: Advanced cybersecurity certification such as a CISSP or SANS 500+ series.
• Depending on the roles focus: Experienced attestation and certification methodologies, such as SOC2.
• Experienced in scripting and automation.
• Experienced understanding cybersecurity assessment tools/techniques.

Physical Requirements

Interact with others requiring the employee to communicate information. Operate computers and other IT equipment requiring the ability to move fingers and hands . See and read computer monitors and documents. Remain sitting or standing for long periods of time to perform work on a computer, telephone, or other equipment.

Location: Lake Park Building. Work City: West Valley City. Work State: Utah. Scheduled Weekly Hours: 40. The hourly range for this position is listed below. Actual hourly rate dependent upon experience: $49.24 - $77.53.

We care about your well‑being – mind, body, and spirit – which is why we provide our caregivers a generous benefits package that covers a wide range of programs to foster a sustainable culture of wellness that encompasses living healthy, happy, secure, connected, and engaged. Learn more about our comprehensive benefits package here.

By applying for a position with Intermountain, I acknowledge that I will comply with all applicable Intermountain policies and expectations. If applying for a remote or hybrid role, this includes remote work expectations related to confidentiality, information security, work schedules, conflicts of interest, and use of company equipment. I further acknowledge that outside employment or activities may not interfere with job responsibilities or create a conflict of interest with Intermountain. Actual or reasonably perceived conflicts may be grounds for disqualification from consideration or, if hired, corrective action up to and including termination of employment.

Intermountin Health is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.

At Intermountin Health, we use the artificial intelligence ("AI") platform, HiredScore to improve your job application experience. HiredScore helps match your skills and experiences to the best jobs for you. While HiredScore assists in reviewing applications, all final decisions are made by Intermountin personnel to ensure fairness. We protect your privacy and follow strict data protection rules. Your information is safe and used only for recruitment. Thank you for considering a career with us and experiencing our AI‑enhanced recruitment process. All positions subject to close without notice.

Headquartered in Utah with locations in six primary states and additional operations across the western U.S., Intermountin Health is a nonprofit system of 34 hospitals, 400+ clinics, a medical group of more than 4,800 employed physicians and advanced care providers, a health plan division called Select Health with more than one million members, and other health services. Helping people live the healthiest lives possible, Intermountin is widely recognized as a leader in clinical quality improvement and efficient healthcare delivery. Join our world‑class team and embark on a career filled with opportunities, strength, innovation, and fulfillment. To find out more about us, head to our career site here.

Intermountin Health’s PEAK program supports caregivers in the pursuit of their education goals and career aspirations by providing up‑front tuition coverage paid directly to the academic institution. The program offers 100+ learning options to choose from, including undergraduate studies, high school diplomas, and professional skills and certificates. Caregivers are eligible to participate in PEAK on day 1 of employment. Learn more.

If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact 1-800-843-7820 or email [e-mail]. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications.

The primary intent of this job description is to set a fair and equitable rate of pay for this classification. Only those key duties necessary for proper job evaluation and/or labor market analysis have been included. Other duties may be assigned by the supervisor. All positions subject to close without notice. Thanks for your interest in continuing your career with our team!