Penetration Testing Manager – Senior Manager InfoSec

This is a fully remote position, open to applicants in North Carolina, +1 more state.

📋 Description

• Lead a team of penetration testers within First Citizens Bank’s Application Security Testing Program.

• Formulate a penetration testing strategy that aligns with Application Security, Vulnerability Management, the Software Development Life Cycle (SDLC), and the bank’s risk appetite.

• Establish a regular cadence for penetration testing that adheres to cybersecurity standards.

• Identify and execute improvement initiatives for the penetration testing team.

• Create testing schedules and coordinate efforts across multiple teams.

• Recognize and address any delays in the testing schedule.

• Oversee staff performance, training, evaluations, and development plans.

• Manage vendor relationships and procure necessary tools and services.

• Offer expert technical guidance on penetration testing methodologies and the remediation of findings.

• Collaborate with application teams, Business Information Security Officers (BISOs), Governance, Risk, and Compliance (GRC), and IT teams to resolve findings and document exceptions.

• Report metrics and analyze data to identify trends and issues.

• Communicate risks and the significance of data to stakeholders and C-level executives.

• Identify, classify, and report complex vulnerabilities in custom applications.

⛳️ Requirements

• A Bachelor's Degree with 8 years of experience OR a High School Diploma or GED/Equivalent with 12 years of experience in information security or technology.

• At least one industry-recognized certification related to penetration testing and/or cybersecurity leadership (CISSP, CISM, GPEN, GWAPT, OSCP, OSWA).

• Experience with agentic penetration testing.

• Comprehensive understanding of the OWASP Top 10.

• Familiarity with the Penetration Testing Execution Standard (PETS).

• Knowledge of CREST Penetration Testing Methodologies.

• Proficient in penetration testing strategy and program management.

• Capability to manage staff performance, training, and evaluations.

• Skills to manage vendors and acquire tools and services.

• Ability to analyze data and report metrics effectively.

• Proficient in communicating risks to diverse audiences, including C-level executives.

• Experience working in information security or technology.

🏝️ Benefits

• Variable incentives, bonuses, benefits, and/or other awards may be included in total compensation.