Senior Mainframe Security Engineer & Penetration Tester

Cybersecurity Jobs; Charlotte (NC); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401k plan

Vacation (10 days in first year)

Job summary

Cybersecurity Jobs is seeking an experienced security engineer for an onsite role in Charlotte, NC. The position focuses on enhancing testing coverage for z/OS and mainframe environments, partnering with teams to validate remediation and strengthen repeatable offensive testing practices.

The candidate will conduct black/grey box and breach testing, work across RACF/ACF2/Top Secret, and validate findings with clear remediation recommendations. PCI DSS and SOX considerations may apply.

Qualifications

• Bachelor’s degree or equivalent education and work experience.
• Minimum of 7 years in security engineering or related cybersecurity roles.
• Deep specialized knowledge of cybersecurity principles, theories, and concepts.

Responsibilities

• Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS, including USS and subsystems like RACF, ACF2, and Top Secret.
• Test core mainframe workloads and interfaces such as CICS, IMS, DB2, MQ, and JCL-based batch components (JES2, TSO/ISPF).
• Assess network-facing services including TN3270, FTP, Z/OS Connect, Rest APIs, and NJE.

Skills

Mainframe security

Threat modeling

Penetration testing

Security engineering

Technical writing

Education

Bachelor’s degree or equivalent

Tools

RACF

ACF2

Top Secret

z/OS

CICS

IMS

DB2

MQ

JCL

TSO/ISPF

REXX

Python

Job description

Cybersecurity Jobs is seeking an experienced security engineer for an onsite role in Charlotte, NC. The position focuses on enhancing testing coverage for z/OS and mainframe environments, partnering with teams to validate remediation and strengthen repeatable offensive testing practices.

The candidate will conduct black/grey box and breach testing, work across RACF/ACF2/Top Secret, and validate findings with clear remediation recommendations. PCI DSS and SOX considerations may apply.