Senior Security Engineer - Penetration Tester

Truist Bank; Atlanta (GA); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) plan

Paid vacation and holidays

Job summary

Truist Bank is seeking an experienced security professional for a high-impact offensive security role. You will conduct penetration testing across applications, AI systems, and infrastructure, and contribute to AI security initiatives.

The position emphasizes threat modeling, secure SDLC practices, and collaboration with engineering, security, and operations teams to strengthen enterprise defenses. Prioritize growth and hands-on problem solving in a fast-paced environment.

Qualifications

• Bachelor’s degree or equivalent education, training, and work-related experience.
• Minimum of 7 years of experience in security engineering or related cybersecurity roles.
• Deep specialized knowledge in cybersecurity principles, theories, and concepts.
• Proven experience in software development lifecycle security practices.
• Deep knowledge of threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.

Responsibilities

• Conduct penetration tests against enterprise applications, infrastructure, cloud platforms, AI systems, APIs, mobile apps, Active Directory environments, and others.
• Simulate real-world attack techniques to identify vulnerabilities and weaknesses.
• Document findings with replication steps, evidence, impact, and remediation.
• Maintain testing artifacts to support regulatory, audit, and compliance needs.
• Defend findings during discussions with teams and leadership.
• Stay current with emerging attack techniques and trends.
• Contribute to AI security testing initiatives and capabilities development.
• Provide feedback to improve testing methodologies, automation, tooling, and processes.
• Mentor junior security professionals and perform peer reviews.

Skills

Penetration testing

Threat modeling

Security testing

Offensive security

Scripting/Automation

Education

Bachelor’s degree or equivalent education, training, and work-related experience

Tools

Active Directory

AI security testing

Mainframe security testing

Job description

Regular

Work Shift: 1st shift (United States of America)

Language Fluency: English (Required)

This is not a role for someone looking to sit on the sidelines.

We’re looking for builders, problem-solvers, and security professionals who thrive in a fast-paced environment where priorities shift, new challenges emerge daily, and your skills directly influence the security posture of a major enterprise. If you enjoy finding vulnerabilities before adversaries do, proposing better ways to test, helping shape new security capabilities, and working alongside a high-performing team that continuously raises the bar, we want to hear from you.

Our team tests a wide variety of technologies including AI, Mainframe, Active Directory, APIs, Web Applications, Infrastructure, Mobile, IoT, Cloud Platforms, Thick Client Applications, Physical Security, and others. We are specifically seeking candidates with experience in AI security testing and/or Mainframe security testing. Expertise in additional testing disciplines is highly valued but not required.

This team operates like a championship organization. The work is meaningful, visible, and impactful. You’ll have the opportunity to influence testing methodologies, shape emerging security capabilities, and help protect critical business operations. The pace is demanding, the expectations are high, and the opportunity for growth is significant.

For this opportunity, Truist will not sponsor an applicant for work visa status or employment authorization, nor will we offer any immigration-related support for this position (including, but not limited to H-1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN-1 or TN-2, E-3, O-1, or future sponsorship for U.S. lawful permanent residence status.)

ESSENTIAL DUTIES AND RESPONSIBILITIES

Penetration Testing

• Conduct penetration tests against enterprise applications, infrastructure, cloud platforms, AI systems, APIs, mobile applications, Active Directory environments, and other technology assets.
• Simulate real-world attack techniques to identify vulnerabilities, attack paths, misconfigurations, and security weaknesses.
• Perform validation and retesting activities to verify remediation efforts and confirm risk reduction.
• Document technical findings with clear reproduction steps, supporting evidence, business impact, and remediation recommendations.
• Maintain testing artifacts and evidence to support regulatory, audit, and compliance requirements.

Offensive Security Expertise

• Defend findings during discussions with application teams, technology leaders, and other stakeholders.
• Participate in escalation calls involving disputed findings, risk discussions, and remediation planning.
• Exercise sound judgment when assessing vulnerability severity and exploitability.
• Collaborate with internal and external testing teams to improve testing coverage and effectiveness.
• Stay current with emerging attack techniques, technologies, and industry trends.

AI Security and Capability Development

• Contribute to AI security testing initiatives and emerging offensive security capabilities.
• Support AI model evaluation, testing, training, and security validation efforts.
• Provide feedback that improves testing methodologies, automation, tooling, and operational processes.
• Identify opportunities to increase testing efficiency, effectiveness, and scalability.

Quality and Collaboration

• Perform peer reviews of penetration testing reports and deliverables.
• Provide technical guidance and mentorship to junior security professionals.
• Collaborate effectively across security, engineering, development, infrastructure teams, app teams, and various levels of management.
• Assist with standards, procedures, playbooks, and testing documentation.
• Support special projects and security initiatives aligned to individual expertise.

Qualifications

Required Qualifications

• Bachelor’s degree or equivalent education, training, and work-related experience.
• Minimum of 7 years of experience in security engineering or related cybersecurity roles.
• Deep specialized knowledge in cybersecurity principles, theories, and concepts.
• Proven experience in software development lifecycle security practices.
• Deep knowledge of threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.

Preferred Qualifications

• 5+ years of penetration testing, red teaming, offensive security, vulnerability research, or related cybersecurity experience.
• Strong technical writing and communication skills.
• Ability to clearly articulate technical risks to both technical and non-technical audiences.
• Ability to independently manage multiple engagements in a dynamic environment.
• Experience defending technical findings and participating in challenging stakeholder discussions.
• Strong analytical and problem-solving skills.
• Ability to adapt quickly to changing priorities, technologies, and business needs.
• Experience with AI Security Testing and/or Mainframe Security Testing.
• Experience performing assessments in one or more of the following are:
• Experience conducting penetration testing, red team, and security assessments across a variety of environments and technologies, including Active Directory, APIs, web applications, infrastructure, cloud platforms, mobile applications, thick/client-server applications, IoT devices, wireless networks, network security, social engineering, and physical security controls.
• Banking, financial services, or highly regulated industry experience.
• Experience supporting red team, purple team, or adversary emulation activities.
• Experience with scripting, automation, and offensive security tool development.

Desired Characteristics

• Is a self-starter who requires minimal supervision.
• Takes ownership and drives work to completion.
• Performs well under demanding workloads and changing priorities.
• Remains professional and effective during conflict and difficult conversations.
• Is comfortable challenging assumptions and presenting evidence-based findings.
• Continuously invests in improving technical and professional skills.
• Demonstrates resilience, accountability, and a strong bias for action.
• Balances individual execution with team success.
• Helps elevate the performance of those around them.

Relevant Certifications

• Offensive Security (OffSec): OSCP+, OSEP, OSED, OSEE, OSWE, OSWA, OSAI
• GIAC: GPEN, GWAPT, GXPN, GRTP, GCFA
• ISC2: CISSP, CRIS
• Hack The Box: CPTS, Active Directory Penetration Tester, Web Exploitation Specialist, Web Exploitation Expert, Offensive AI Expert
• *Equivalent offensive security, penetration testing, red team, exploit development, web application security, or digital forensics certifications will also be considered.

Why Join Us?

You’ll work alongside highly skilled security professionals tackling real-world challenges across diverse technologies. Every engagement is an opportunity to learn, improve, and strengthen enterprise defenses. If you’re energized by continuous growth, technical excellence, meaningful impact, and the opportunity to help shape the future of offensive security, this is the place to do it.

To comply with the Illinois pay transparency statute and for work locations in Illinois only, the annual base salary for this position is $120,000-$170,000. Additional incentive pay is available for this position.

General Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist’s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.

Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.

EEO is the Law E-Verify IER Right to Work