Senior Security Engineer - Penetration Tester

MainframeMaster; Atlanta, Northern (GA, KY); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Truist is seeking a Senior Security Engineer - Penetration Tester to join a fast-paced, security-focused team. The role involves hands-on penetration testing across enterprise apps, infrastructure, cloud, AI systems, APIs, and mobile applications while shaping new security capabilities.

The ideal candidate has 7+ years in security engineering, strong written and verbal communication, and the ability to manage multiple engagements in a dynamic environment.

Qualifications

• Bachelor’s degree or equivalent education, training, and work-related experience.
• 7+ years of security engineering or related cybersecurity experience.
• Deep knowledge of security testing, threat modeling, and penetration testing.
• Experience implementing and managing complex information security technologies.

Responsibilities

• Conduct penetration tests against enterprise applications, infrastructure, cloud platforms, APIs, mobile and AD environments.
• Document findings with reproduction steps, business impact, and remediation recommendations.
• Maintain testing artifacts to support regulatory, audit, and compliance requirements.
• Collaborate with teams to improve testing coverage and effectiveness and stay current with evolving attack techniques.

Skills

Penetration testing

Threat modeling

Security engineering

Scripting

Automation

Education

Bachelor's degree or equivalent

Job description

# Senior Security Engineer - Penetration TesterTruistFull-timeAtlanta, Georgia, USA, Charlotte, North Carolina, USA, Raleigh, North Carolina, USA0 viewsPosted September 20, 2026## Job DescriptionThis is not a role for someone looking to sit on the sidelines. We are looking for builders, problem-solvers, and security professionals who thrive in a fast-paced environment where priorities shift, new challenges emerge daily, and your skills directly influence the security posture of a major enterprise. If you enjoy finding vulnerabilities before adversaries do, proposing better ways to test, helping shape new security capabilities, and working alongside a high-performing team that continuously raises the bar, we want to hear from you. Our team tests a wide variety of technologies including **AI**, **Mainframe**, **Active Directory**, **APIs**, **Web Applications**, **Infrastructure**, **Mobile**, **IoT**, **Cloud Platforms**, **Thick Client Applications**, **Physical Security**, and others. We are specifically seeking candidates with experience in **AI** security testing and/or **Mainframe** security testing. Expertise in additional testing disciplines is highly valued but not required.ESSENTIAL DUTIES AND RESPONSIBILITIESPenetration TestingConduct penetration tests against enterprise applications, **infrastructure**, **cloud platforms**, **AI** systems, **APIs**, **mobile** applications, **Active Directory** environments, and other technology assets.Simulate real-world attack techniques to identify vulnerabilities, attack paths, misconfigurations, and security weaknesses.Perform validation and retesting activities to verify remediation efforts and confirm risk reduction.Document technical findings with clear reproduction steps, supporting evidence, business impact, and remediation recommendations.Maintain testing artifacts and evidence to support regulatory, audit, and compliance requirements.Offensive Security ExpertiseDefend findings during discussions with application teams, technology leaders, and other stakeholders.Participate in escalation calls involving disputed findings, risk discussions, and remediation planning.Exercise sound judgment when assessing vulnerability severity and exploitability.Collaborate with internal and external testing teams to improve testing coverage and effectiveness.Stay current with emerging attack techniques, technologies, and industry trends.**AI** Security and Capability DevelopmentContribute to **AI** security testing initiatives and emerging offensive security capabilities.Support **AI** model evaluation, testing, training, and security validation efforts.Provide feedback that improves testing methodologies, automation, tooling, and operational processes.Identify opportunities to increase testing efficiency, effectiveness, and scalability.Quality and CollaborationPerform peer reviews of penetration testing reports and deliverables.Provide technical guidance and mentorship to junior security professionals.Collaborate effectively across security, engineering, development, **infrastructure** teams, app teams, and various levels of management.Assist with standards, procedures, playbooks, and testing documentation.Support special projects and security initiatives aligned to individual expertise.## Requirements & SkillsQualificationsRequired QualificationsBachelor’s degree or equivalent education, training, and work-related experience.Minimum of 7 years of experience in security engineering or related cybersecurity roles.Deep specialized knowledge in cybersecurity principles, theories, and concepts.Proven experience in software development lifecycle security practices.Deep knowledge of threat modeling, security testing, and penetration testing.Experience implementing and managing complex information security technologies.Preferred Qualifications5+ years of penetration testing, red teaming, offensive security, vulnerability research, or related cybersecurity experience.Strong technical writing and communication skills.Ability to clearly articulate technical risks to both technical and non-technical audiences.Ability to independently manage multiple engagements in a dynamic environment.Experience defending technical findings and participating in challenging stakeholder discussions.Strong analytical and problem-solving skills.Ability to adapt quickly to changing priorities, technologies, and business needs.Experience with **AI** Security Testing and/or **Mainframe** Security Testing.Experience performing assessments in one or more of the following are:Experience conducting penetration testing, red team, and security assessments across a variety of environments and technologies, including **Active Directory**, **APIs**, **web applications**, **infrastructure**, **cloud platforms**, **mobile** applications, thick/client-server applications, **IoT** devices, wireless networks, network security, social engineering, and **physical security** controls.Banking, financial services, or highly regulated industry experience.Experience supporting red team, purple team, or adversary emulation activities.Experience with scripting, automation, and offensive security tool development.Desired CharacteristicsIs a self-starter who requires minimal supervision.Takes ownership and drives work to completion.Performs well under demanding workloads and changing priorities.Remains professional and effective during conflict and difficult conversations.Is comfortable challenging assumptions and presenting evidence-based findings.Continuously invests in improving technical and professional skills.Demonstrates resilience, accountability, and a strong bias for action.Balances individual execution with team success.Helps elevate the performance of those around them.Relevant CertificationsCandidates may hold one or more of the following industry-recognized certifications:Offensive Security (OffSec): OSCP+, OSEP, OSED, OSEE, OSWE, OSWA, OSAIGIAC: GPEN, GWAPT, GXPN, GRTP, GCFAISC2: CISSP, CRISHack The Box: CPTS, **Active Directory** Penetration Tester, Web Exploitation Specialist, Web Exploitation Expert, Offensive **AI** Expert## How to ApplyApply directly through the application link above