Posted: 18 June
The role
Who We Are Looking For
We are seeking a Manager to lead State Street’s Penetration Testing Team, reporting into leadership within the Threat Intelligence and Assurance function. This role combines technical leadership with program ownership, focused on delivering high-quality, engineering-driven penetration testing across a complex, highly regulated financial environment. You will be responsible for building and maturing a team that performs rigorous, hands‑on assessments across applications, networks, APIs, and cloud platforms, while establishing consistent, risk‑aligned testing practices. The Manager is accountable for defining technical standards, ensuring depth and quality of testing, and delivering outputs that are evidence‑based, reproducible, and aligned with audit and regulatory expectations. Working closely with engineering, architecture, and risk partners, you will ensure testing results translate into measurable risk reduction and sustained improvements in secure system design and implementation.
What You Will Be Responsible For
Lead, mentor, and develop a team of penetration testers, fostering strong technical depth, hands‑on expertise, and continuous skill development across application, network, and cloud domains
Own and evolve the penetration testing program, including methodologies, tooling, quality assurance practices, reporting standards, and risk‑based prioritization of testing activities
Drive delivery of high quality, hands‑on testing across enterprise applications, APIs, infrastructure, and cloud environments, ensuring assessments are technically rigorous and aligned to real‑world exploitability
Establish and enforce engineering‑centric testing standards, ensuring consistency, reproducibility, and depth across both internal and third‑party executed assessments
Oversee and coordinate testing performed by external providers, including scoping, execution expectations, and technical validation of results to ensure quality and accuracy
Ensure regulator and audit ready outputs, including clear documentation, evidence‑based findings, and reporting that ties technical vulnerabilities to business and risk impact
Partner with engineering, infrastructure, and architecture teams to drive effective remediation, validate fixes, and improve secure design and development practices
Integrate emerging technologies and techniques into the program, including AI/LLM‑focused testing approaches and assurance of enterprise AI deployments (e.g., prompt injection, model abuse, data exposure)
Track, analyze, and communicate program metrics, including coverage, risk trends, vulnerability recurrence, and remediation performance, providing clear insights to senior leadership
Continuously improve program maturity, balancing technical depth with scalability, consistency, and alignment to evolving threats, technologies, and regulatory expectations
What We Value
Leadership through influence and accountability, with a focus on developing talent and building high‑trust teams.
Risk‑based decision making, prioritizing what matters most in complex, regulated environments.
Technical depth with strategic perspective—ability to connect hands‑on findings to enterprise risk outcomes.
Clear, executive‑ready communication tailored to technical and non‑technical audiences.
Curiosity and continuous learning, especially in emerging areas such as AI/LLM security.
Collaboration and partnership across engineering, risk, and business stakeholders.
Ownership and bias for action, ensuring issues are driven through remediation and closure.
Education & Preferred Qualifications
8+ years in offensive security with experience in high security/highly regulated environments; 2+ years leading teams preferred.
Deep expertise in network and application penetration testing, including enterprise attack paths and complex application ecosystems.
Strong knowledge of cloud, containerized environments, and identity‑centric architectures.
Demonstrated ability to translate findings into actionable, risk‑based remediation.
Strong stakeholder engagement and executive communication skills.
Prior successful experience working with technology owners and business unit leaders to reduce risk
Nice to have: experience using AI/LLM tools to perform network and application penetration testing and configuration/security reviews.
Education/Certifications (desired, not mandatory): BS/MS in relevant field; OSCP/OSEP/OSCE, GPEN/GXPN, GWAPT, GCPN, PNPT, CREST (CRT, CCT INF, CCT APP, CCRTS, CCRTM) or similar.
Salary Range
$140,000 - $222,500 Annual
Benefits
Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long‑term disability, and other optional additional coverages; paid‑time off including vacation, sick leave, short program disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance‑based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.
EEO Statement
As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.
Job Application Disclosure
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
Job ID: R-792072
#J-18808-Ljbffr
