Senior Penetration Tester

Testing Site - JPMC; Washington (District of Columbia); On-site; USD 134,000 - 281,000; Full time

Benefits offered by this job

Comprehensive health care coverage

On-site health centers

Retirement savings plan

Backup childcare

Tuition reimbursement

Mental health support

Financial coaching

Job summary

JPMorgan Chase & Co. is seeking a senior Assessments & Exercises VP to drive the security of critical banking applications and platforms through hands-on penetration testing.

You will plan, execute, and report on engagements across web, API, cloud, and mobile environments, leading with industry-standard methods and strong remediation guidance. The role requires deep expertise in offensive security, clear communication, and a commitment to mentoring junior testers while staying current on new

Qualifications

• 5+ years of hands-on penetration testing experience in offensive security.
• Expertise in manual testing of web, API, cloud (AWS/Azure/GCP), infrastructure, thick-client, and mobile apps.
• Strong understanding of security assessment methodologies such as OWASP Top Ten and NIST CSF.
• Ability to identify systemic security issues and provide actionable remediation recommendations.
• Exceptional organizational and communication skills, including the ability to write detailed technical reports for technical and non-technical stakeholders.
• Experience conducting peer reviews of penetration test reports and mentoring junior testers.
• Continuous learner who keeps up with latest offensive security trends, tools, and techniques.

Responsibilities

• Plan, scope, and execute penetration testing engagements across a variety of environments.
• Collect and validate prerequisites for each engagement, including access and approvals.
• Perform manual and automated testing to identify vulnerabilities and weaknesses.
• Document and communicate findings with risk assessments and remediation guidance.
• Conduct peer reviews of reports to ensure accuracy and quality.
• Collaborate with development, infrastructure, and security teams to support remediation.
• Stay current with emerging threats and attack techniques through research and industry groups.
• Contribute to improving testing methodologies, tools, and frameworks.

Skills

Penetration testing

Web/API/Cloud testing

Security frameworks

Issue identification

Communication

Peer reviews

Mentoring

Continuous learning

Tools

Burp Suite

Nmap

Metasploit

Job description

Job Information

• Job Identification 210692981
• Job Category Cybersecurity Operations
• Business Unit Corporate Sector
• Posting Date 04/02/2026, 07:31 PM
• Locations 875 15th St NW, Washington, DC, 20005, US 3424 Peachtree Rd NE, Atlanta, GA, 30326, US 10430 Highland Manor Dr, Tampa, FL, 33610, US 1750 Tysons Blvd, McLean, VA, 22102, US 10 S Dearborn St, Chicago, IL, 60603, US 600 Travis St, Houston, TX, 77002, US 1111 Polaris Pkwy, Columbus, OH, 43240, US 880 Powder Mill Rd, Wilmington, DE, 19803, US 8181 Communications Pkwy Bldg F, Plano, TX, 75024, US
• Job Schedule Full time
• Base Pay/Salary Washington,DC $133,760.00-$280,800.00; Chicago,IL $117,040.00-$243,000.00

About Us

JPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world’s most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management.

We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions.

We also offer a range of benefits and programs to meet employee needs, based on eligibility.

• comprehensive health care coverage
• on‑site health and wellness centers
• a retirement savings plan
• backup childcare
• tuition reimbursement
• mental health support
• financial coaching

and more.

We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants’ and employees’ religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.

JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans

Job Description

Drive the security of critical banking applications and platforms through hands-on offensive testing.

As an Assessments & Exercises Vice President in the Cybersecurity and Technology Controls organization, you will play a key role in safeguarding the firm’s most vital assets. Your primary responsibility will be to plan, execute, and report on penetration tests targeting high-impact applications, platforms, and services. Leveraging industry-standard methodologies and advanced techniques, you will proactively identify vulnerabilities, collaborate with application owners to understand root causes, and guide effective remediation to strengthen the firm’s security posture.

We are seeking candidates with a passion for offensive security, deep technical expertise in penetration testing, and a commitment to continuous learning and excellence.

Job responsibilities

• Plan, scope, and execute penetration testing engagements across a variety of environments, including web applications, APIs, cloud platforms, infrastructure, thick-client, and/or mobile applications.
• Collect and validate pre-requisites for each engagement, ensuring all necessary access, documentation, and approvals are in place.
• Perform manual and automated testing to identify vulnerabilities, misconfigurations, and security weaknesses, leveraging industry-standard tools and custom scripts.
• Document and communicate findings through comprehensive reports that include technical details, risk assessments, and actionable remediation recommendations.
• Conduct peer reviews of penetration test reports to ensure accuracy, consistency, and quality of deliverables.
• Collaborate with development, infrastructure, and security teams to clarify findings, support remediation efforts, and provide subject matter expertise on offensive security.
• Stay current with emerging threats, vulnerabilities, and attack techniques by leveraging threat intelligence, security research, and participation in relevant industry groups.
• Contribute to the continuous improvement of penetration testing methodologies, tools, and frameworks to enhance effectiveness and alignment with firm strategy and regulatory requirements.

Required qualifications, capabilities, and skills

• 5+ years of hands-on penetration testing experience in offensive security, with a proven track record of scoping, executing, and reporting on complex engagements.
• Expertise in manual penetration testing of web, API, cloud (AWS/Azure/GCP), infrastructure, thick-client, and/or mobile applications (android/iOS), including the use of industry-standard tools (e.g., Burp Suite, Nmap, Metasploit, etc.).
• Strong understanding of security assessment methodologies such as OWASP Top Ten, NIST Cybersecurity Framework, and other relevant standards.
• Ability to identify and articulate systemic security issues related to threats, vulnerabilities, and risks, and provide clear, actionable recommendations for remediation.
• Exceptional organizational and communication skills, including the ability to write detailed technical reports and present findings to both technical and non-technical stakeholders.
• Experience conducting peer reviews of penetration test reports and mentoring junior testers.
• Continuous learner who keeps up with the latest offensive security trends, tools, and techniques.

Preferred qualifications, capabilities, and skills

• Knowledge of cybersecurity practices, operational risk management, and incident response methodologies within the US financial services sector, including relevant regulations, threats, and risks.
• Proficiency in penetration testing and security concepts for both Windows and Unix-like operating systems.
• Experience conducting security-focused source code reviews (e.g., Python, Java, Rust).
• Experience in reverse engineering thick-client and mobile applications to identify vulnerabilities.
• Relevant certifications such as OSWE, CREST (CRT, CCT), OSCP, OSCE, GXPN, GWAPT, GPEN, GMOB, or BSCP.

About the Team

Our professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we’re setting our businesses, clients, customers and employees up for success.