Senior Penetration Tester for Regulated Environments

State Street; Quincy (MA); Hybrid; USD 120,000 - 203,000; Full time

Benefits offered by this job

401K with company match

Health insurance & other comprehensive

Paid time off

Job summary

State Street seeks a Senior Penetration Testing Engineer to join the Penetration Testing Team within the Threat Intelligence and Assurance organization. This deeply technical role emphasizes hands-on testing, risk-aligned outputs, and collaboration with engineering to drive secure design.

You will lead end-to-end network and application tests, validate fixes, and deliver regulator-ready reports with actionable remediation guidance in a highly regulated banking environment.

Qualifications

• 5+ years in penetration testing across application and network in high-security environments.
• Experience managing third-party penetration testing vendors and QA.
• Deep expertise in web, API, and mobile app testing and understanding enterprise attack paths.
• Strong knowledge of cloud-native architectures and identity platforms.
• Ability to translate findings into actionable remediation guidance and influence stakeholders.
• Nice to have: AI/LLM tools for testing and reviews.

Responsibilities

• Design and manage third-party network penetration tests, including scoping, vendor selection, rules of engagement, quality assurance, and validation of results.
• Lead end-to-end application testing across internal and third-party providers (web, API), including scoping, execution, exploitation, and retesting.
• Perform advanced testing across authn/authz, business logic, injection, API abuse, crypto misuse, and access control weaknesses.
• Establish and enforce testing standards for internal teams and external vendors for consistency and regulatory defensibility.
• Deliver regulator-ready reports with clear exploitability, risk context, and remediation guidance.
• Lead AI/LLM-enabled testing techniques and assurance testing of enterprise AI/LLM deployments.
• Partner with engineering and infrastructure to validate remediation and strengthen secure development.

Skills

Penetration testing

Vendor management

Application security

Network security

Regulatory awareness

AI/LLM testing

Communication

Education

Bachelor's or Master’s degree in relevant field

C ertifications: OSCP/OSEP/OSWE, GPEN/GXPN, GWAPT, PNPT, GCPN

Tools

CI/CD pipelines

Job description

State Street seeks a Senior Penetration Testing Engineer to join the Penetration Testing Team within the Threat Intelligence and Assurance organization. This deeply technical role emphasizes hands-on testing, risk-aligned outputs, and collaboration with engineering to drive secure design.

You will lead end-to-end network and application tests, validate fixes, and deliver regulator-ready reports with actionable remediation guidance in a highly regulated banking environment.