Senior Offensive Penetration Tester – Mobile, API & Cloud

Us Bank; Irving (TX); On-site; USD 150,000 - 210,000; Full time

Benefits offered by this job

Healthcare (medical, dental, vision)

Life insurance

Disability insurance

Parental leave

401(k) and retirement plan

Paid vacation

Job summary

U.S. Bank is seeking a Senior Penetration Tester to lead advanced offensive security assessments across mobile apps, APIs, web platforms, and cloud environments.

You will identify vulnerabilities, validate risk, and partner with engineering teams to improve enterprise security posture. The role requires 8+ years in information security, 5+ years in mobile security testing (Android and iOS), and strong expertise in OWASP/MASTG frameworks, plus hands-on testing with Burp Suite, Nmap, Metasploit

Qualifications

• Eight or more years of information security experience.
• Five or more years of hands-on mobile app security testing for Android and iOS.
• Strong knowledge of OWASP Top 10, API Security Top 10, SANS Top 25, OWASP MASVS, and MASTG frameworks.
• Advanced experience conducting manual penetration testing, exploit chaining, business logic testing, and access control assessments.

Responsibilities

• Lead penetration testing engagements across mobile applications, APIs, web applications, cloud platforms, and supporting infrastructure.
• Perform manual security testing and exploitation to identify vulnerabilities and demonstrate business impact.
• Evaluate security controls within AWS, Azure, containerized environments, and Kubernetes platforms.
• Develop detailed security reports with vulnerability analysis, risk ratings, attack paths, and remediation recommendations.

Skills

Information security

Mobile security testing

Penetration testing

Threat modeling

Security reporting

Education

Bachelor's degree in Engineering or Science

Tools

Burp Suite Pro

Postman

Insomnia

Nmap

Metasploit

Kali Linux

Job description

U.S. Bank is seeking a Senior Penetration Tester to lead advanced offensive security assessments across mobile apps, APIs, web platforms, and cloud environments.

You will identify vulnerabilities, validate risk, and partner with engineering teams to improve enterprise security posture. The role requires 8+ years in information security, 5+ years in mobile security testing (Android and iOS), and strong expertise in OWASP/MASTG frameworks, plus hands-on testing with Burp Suite, Nmap, Metasploit