Senior Penetration Testing Engineer — Hybrid, Reg-Ready

STATE STREET CORPORATION; Clifton (NJ); Hybrid; USD 120,000 - 203,000; Full time

Benefits offered by this job

401K with company match

Insurance coverage: medical, dental, 6

Paid time off including vacation, sick

Employee Assistance Program

Incentive compensation

Tax-advantaged savings plans

Job summary

State Street Corporation is seeking a Senior Penetration Testing Engineer to join our Threat Intelligence and Assurance team. This highly technical role focuses on rigorous, repeatable testing across complex systems, including third-party vendors, with emphasis on identifying exploitability and risk context.

The ideal candidate has 5+ years in pentesting in regulated environments, strong knowledge of web/API security, and experience with AI/LLM-enabled testing.

Qualifications

• 5+ years in penetration testing in high-security environments.
• Experience managing third-party penetration testing vendors and ensuring outcomes.
• Deep expertise in application testing (web, APIs, mobile) and enterprise network attack paths.
• Knowledge of modern architectures (cloud-native, microservices, CI/CD).

Responsibilities

• Design and manage third‑party network penetration tests, including scoping, vendor selection, rules of engagement, QA, and validation of results.
• Lead end‑to‑end application penetration testing across internal and external providers (web, API), including scoping, execution, exploitation, and retesting.
• Perform advanced testing across authn/authz, business logic, injection, API abuse, crypto misuse, and access control weaknesses.
• Establish and enforce testing standards for internal teams and external vendors for consistency and defensibility.
• Deliver regulator-ready reporting with clear exploitability, risk context, and remediation guidance.
• Lead AI/LLM-enabled testing techniques and assurance testing of enterprise AI deployments.
• Partner with engineering to validate remediation and strengthen secure development practices.

Skills

Penetration testing

Application testing

Network testing

AI/LLM techniques

Vendor management

Secure development

Education

BS/MS in relevant field

OSCP/OSEP/OSWE/GPEN/GXPN/GWAPT/PNPT/GCPN or similar

Job description

State Street Corporation is seeking a Senior Penetration Testing Engineer to join our Threat Intelligence and Assurance team. This highly technical role focuses on rigorous, repeatable testing across complex systems, including third-party vendors, with emphasis on identifying exploitability and risk context.

The ideal candidate has 5+ years in pentesting in regulated environments, strong knowledge of web/API security, and experience with AI/LLM-enabled testing.