Senior Penetration Testing Engineer

McKesson; Kentucky; On-site; USD 127,600 - 212,600; Full time

Job summary

McKesson is looking for a seasoned Senior Penetration Testing Engineer to join its Pentest Team in Kentucky. This role is crucial in identifying and mitigating security vulnerabilities within applications, infrastructure, and cloud environments.

The ideal candidate will possess expertise in offensive security, threat simulation, and vulnerability exploitation, as well as proficiency in various security testing tools.

The position offers a competitive salary range between $127,600 and $212,600, alongside a comprehensive compensation package.

Qualifications

• 7+ years of experience in penetration testing and offensive security.
• Understanding of secure coding practices and common vulnerabilities.
• Strong problem-solving abilities.

Responsibilities

• Plan and execute penetration tests across various platforms.
• Identify vulnerabilities with automated tools and manual testing.
• Deliver detailed reports to stakeholders.

Skills

Scripting languages (Python, Bash, PowerShell)

Burp Suite Pro

Owasp ZAP

Nmap

Kali Linux tools

Cloud penetration testing (AWS, Azure, GCP)

Analytical skills

Communication skills

Education

Bachelor’s degree in Computer Science or Cybersecurity

Tools

Security testing tools (SAST, DAST, SCA)

Job description

McKesson is a leading healthcare services company.

The McKesson Pentest Team (MPT) is seeking a seasoned Senior Penetration Testing Engineer to join our team and organization. At its core, our mission is to identify what truly breaks security and ensure those weaknesses are resolved before they can be exploited.

This role is critical in proactively identifying and mitigating security vulnerabilities across our applications, infrastructure, and cloud environments. The ideal candidate will have extensive experience in offensive security, red teaming, and vulnerability exploitation, and will strengthen our security posture through rigorous testing and threat simulation.

Penetration Testing

• Plan, execute, and report on penetration tests targeting web applications, APIs, mobile applications, infrastructure, and cloud environments across McKesson.
• Identify exploitable vulnerabilities with both automated tools and manual techniques.
• Assist system and application owners in understanding risk and implementing effective remediation.
• Develop customized tools and exploitation techniques to support advanced testing tailored to specific engagements.
• Collaborate and communicate effectively with external penetration testing vendors and service providers.

Security Tooling & Automation

• Develop and maintain custom scripts and tools to support testing activities.
• Contribute to the integration of security tools and processes within CI/CD pipelines to improve testing coverage and efficiency.
• Evaluate and deploy commercial and open‑source security testing tools.

Project Management

• Partner with application teams to gain a thorough understanding of environments and define scope for business critical McKesson applications.
• Define scope and track compliance of applications and entities with penetration testing policy requirements, including PCI DSS, HIPAA, and SOC.
• Schedule and coordinate outreach with application teams to manage engagements with internal or external vendor resources.

Reporting & Communication

• Deliver detailed, actionable reports to technical and non‑technical stakeholders.
• Present findings and recommendations to engineering, operations, and leadership teams.
• Maintain documentation of testing methodologies, tools, and results.

Security Research & Innovation

• Stay current with emerging threats, vulnerabilities, and offensive security techniques.
• Participate in threat modeling and contribute to the development of attack simulations.
• Mentor junior team members and contribute to internal knowledge sharing.

Minimum Requirements

• Degree or equivalent; typically requires 7+ years of relevant experience.

Critical Experience / Technical Skills

• Proficiency in scripting languages such as Python, Bash, or PowerShell.
• Expertise in tools such as Burp Suite Pro, Owasp ZAP, Nmap, and Kali Linux suite of tools for Web and Network Penetration testing.
• Experience with cloud penetration testing (AWS, Azure, GCP).
• Familiarity with MITRE ATT&CK framework and threat emulation techniques.
• Understanding of secure coding practices and common vulnerabilities (e.g., OWASP Top 10).
• Strong analytical and problem‑solving abilities.
• Excellent written and verbal communication skills.
• Project and time management skills.

Preferred Knowledge & Skills

• Bachelor’s degree (in Computer Science, Cybersecurity, or a related field) or equivalent work experience.
• Advanced certifications (e.g., OSCP, OSWA, OSWE, OSEP, OSCE, BSCP, HTB CWES, HTB CWEE, or other).
• Experience in purple teaming and collaboration with defensive security teams.
• Experience managing application security tools, including SAST, DAST, SCA, and WAF solutions.
• Experience with bug bounty programs, including platforms such as HackerOne and Bugcrowd.
• Knowledge of regulatory frameworks, including PCI DSS, HIPAA, and NIST standards.
• Interest in and experience with AI, including development, infrastructure, agents, penetration testing, or red teaming use cases (e.g., XBOW, Hadrian NOVA, Horizon3, Pentera, vPenTest, or open source alternatives).

Base Pay Range

$127,600 - $212,600

Competitive compensation package includes base pay, annual bonus, long‑term incentives, and benefits. Pay is compliant with applicable regulations.

McKesson is an Equal Opportunity Employer and offers opportunities to all job seekers, including those with disabilities. For reasonable accommodation requests, contact [e-mail] or [e-mail]. Resumes or CVs submitted to this email will not be accepted.