Senior Penetration Test Engineer - Cloud & App Security

1101 S&P Global Inc.; United States; Remote; USD 135,000 - 200,000; Full time

Benefits offered by this job

Health & Wellness

Flexible Downtime

Continuous Learning

Invest in Your Future

Family Friendly Perks

Beyond the Basics

Job summary

S&P Global is seeking a Lead Penetration Test Engineer to drive offensive security across web, cloud, and infrastructure. The role combines hands-on testing with threat research, automation in CI/CD, and collaboration with engineering teams to remediate findings.

You will report on complex risks to executives, mentor teams, and help strengthen the organization's security posture through rigorous testing, tooling, and method development across North America.

Qualifications

• Minimum 8 years of information security with a focus on penetration testing, app security, and vulnerability management.
• Hands-on experience with penetration testing tools and methodologies (OWASP Top 10, MITRE ATT&CK, PTES).
• Experience identifying/exploiting common infra and web app vulnerabilities (XSS, SQLi, IDOR).
• Strong scripting/programming skills (Bash, Python, Go, PowerShell, JavaScript).
• Ability to translate findings into clear reports for cross-functional teams and executives.
• At least one offensive security certification (OSCP, OSCE3, OSEP, GXPN, GPEN, or CREST).
• Bachelor’s degree in Computer Science, Information Systems, or related field, or equivalent experience.

Responsibilities

• Conduct comprehensive penetration testing of web apps, infrastructure, and cloud environments using manual and automated techniques.
• Develop custom scripts/tools to enhance testing and automate security checks in CI/CD pipelines.
• Lead vulnerability assessments and remediation planning with engineering teams.
• Perform DAST, SAST, SCA, and credential scanning to validate security controls.
• Lead attack simulations and threat research to improve defenses.
• Communicate findings to technical and non-technical stakeholders and provide remediation guidance.

Skills

Penetration testing

Application security

Vulnerability management

Scripting (Bash, Python)

CI/CD security

Threat modeling

Cloud security

Offensive security methodologies

Security reporting

Communication to executives

Education

Bachelor's degree in CS/IS or related

Tools

Burp Suite

Nessus

Metasploit

Nmap

Job description

S&P Global is seeking a Lead Penetration Test Engineer to drive offensive security across web, cloud, and infrastructure. The role combines hands-on testing with threat research, automation in CI/CD, and collaboration with engineering teams to remediate findings.

You will report on complex risks to executives, mentor teams, and help strengthen the organization's security posture through rigorous testing, tooling, and method development across North America.