VP-Level Penetration Testing Lead

State Street; Clifton (NJ); On-site; USD 120,000 - 203,000; Full time

Benefits offered by this job

401K match

Insurance coverage

Paid time off

Employee Assistance

Performance awards

Job summary

State Street seeks a Vice President, Penetration Testing Analyst, to join the Threat Intelligence and Assurance organization. This senior, hands-on role serves as the in-house technical authority for complex penetration testing engagements and validation of remediation.

You will lead scenario-based testing against high-value systems, coordinate with owners, external providers, and security teams, and ensure findings are actionable and defensible.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or related field, or equivalent practical experience.
• 10+ years of related experience.
• Industry-recognized offensive security certifications such as OSCP, OSEP, OSCE3, CRTO, GXPN, or equivalent.
• Experience supporting large-scale remediation validation programs is strongly preferred.

Responsibilities

• Serve as the senior technical lead across the engagement lifecycle, including scoping, test planning, rules of engagement, execution oversight, and post-test remediation planning.
• Provide real-time technical guidance during engagements by assessing tester activity, judging operational risk, and guiding escalation decisions with appropriate discretion.
• Hold external testing providers to a high technical standard by challenging their attack paths, evidence quality, severity ratings, and MITRE ATT&CK mapping, so that results are accurate, actionable, and defensible.
• Lead coordination with finding owners and engineering teams to turn findings into clear technical remediation requirements and measurable validation criteria, so fixes address root causes rather than narrow point issues.
• Lead the strategy for validating remediation. This includes grouping related findings, defining test criteria and expected outcomes, and personally retesting fixes against the original attack path and other ways of reaching the same objective.
• Assess remediation across the wider estate, including variant attack paths, implementation consistency, and any new exposure the fix itself introduces.
• Make the final technical call on closure recommendations, backed by evidence-based reporting that confirms each finding as closed, open, or partially closed, with executive summaries for senior and non-technical audiences.
• Present testing and validation outcomes to senior leadership and governance forums, and defend the technical basis for findings, residual risk, and closure decisions.
• Design and lead targeted TTP assessments and collaborative purple team exercises, so that detection, response, and preventive controls are validated against relevant attacker behavior.
• Feed detection and control gaps found during testing to Detection Engineering, Assurance, and Security Operations, and track the resulting improvements through validation.
• Provide offensive security support to partner teams, including risk and regulatory functions, and help set the methods, test plans, evidence standards, and lessons-learned practices that mature the internal capability. You will also mentor team members and partners.

Skills

Offensive security

Active Directory

Entra ID

Privilege escalation

Lateral movement

EDR evasion

Cloud attacks

Azure/AWS

Cobalt Strike

BloodHound

Mimikatz

Metasploit

Kali Linux

Python

PowerShell

Remediation validation

MITRE ATT&CK

Test design

Executive communication

Education

Bachelor's degree in Computer Science, Cybersecurity, or related field

10+ years of related experience

OSCP

OSEP

OSCE3

CRTO

GXPN

Tools

Cobalt Strike

BloodHound

Mimikatz

Metasploit

Kali Linux

Azure

AWS

Job description

State Street seeks a Vice President, Penetration Testing Analyst, to join the Threat Intelligence and Assurance organization. This senior, hands-on role serves as the in-house technical authority for complex penetration testing engagements and validation of remediation.

You will lead scenario-based testing against high-value systems, coordinate with owners, external providers, and security teams, and ensure findings are actionable and defensible.