Senior Mainframe and Web Application Security Engineer – Senior Penetration Tester

This is a fully remote position, open to applicants in North Carolina, +1 more state.

📋 Description

• Execute advanced penetration testing and security evaluations across enterprise technologies, with a focus on mainframe environments.

• Carry out black box, grey box, and assumed breach penetration assessments of enterprise z/OS environments.

• Evaluate USS, RACF, ACF2, Top Secret, CICS, IMS, Db2, MQ, JCL, JES2, TSO/ISPF, TN3270, FTP, z/OS Connect, REST APIs, and NJE.

• Employ manual techniques, custom scripting, and offensive tools to identify users and resources, map datasets, access unsecured spool and job outputs, and exploit misconfigurations and insecure interfaces.

• Analyze exploitability and business impact, and ascertain finding severity and risk levels.

• Document findings with reproduction steps, evidence, impact statements, and remediation suggestions.

• Present and justify technical findings to application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders.

• Conduct validation and retesting to verify remediation and risk mitigation.

• Maintain testing evidence to support audit, regulatory, and compliance requirements including PCI DSS and SOX.

• Collaborate with both internal and external testing teams to enhance testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes.

• Perform peer reviews of penetration testing reports and offer technical guidance and mentorship.

• Stay updated on mainframe attack techniques, security controls, platform changes, offensive security practices, and pertinent industry threats.

⛳️ Requirements

• Bachelor’s degree or equivalent education, training, and work experience.

• At least 7 years of experience in security engineering or related cybersecurity positions.

• Extensive specialized knowledge in cybersecurity principles, theories, and concepts.

• Demonstrated experience in security practices throughout the software development lifecycle.

• Profound understanding of threat modeling, security testing, and penetration testing.

• Experience in implementing and managing complex information security technologies.

• A minimum of five years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience.

• Practical experience assessing mainframe environments, including z/OS and standard security components such as RACF, ACF2, or Top Secret.

• Familiarity with mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening.

• Skilled in identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments.

• Strong technical writing and communication abilities, including the capability to explain and defend technical findings to both technical and non-technical audiences.

• Ability to independently manage multiple testing engagements, adapt strategies as priorities and requirements shift, and ensure task completion.

• Experience in developing scripts, automation, or AI-enabled tools that optimize testing activities and enhance the efficiency of repeatable processes.

• Background in banking, financial services, or another highly regulated industry.

• Relevant offensive security certifications such as OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials.

• Proficiency in the English language is required.

• Must not require employer sponsorship for work visa status or employment authorization.

🏝️ Benefits

• Medical insurance.

• Dental insurance.

• Vision insurance.

• Life insurance.

• Disability insurance.

• Accidental death and dismemberment coverage.

• Tax-preferred savings accounts.

• 401k plan.

• A minimum of 10 days of vacation during the first year of employment.

• 10 sick days.

• Paid holidays.

• Defined benefit pension plan may be available depending on position and division.

• Restricted stock units may be available depending on position and division.

• Deferred compensation plan may be available depending on position and division.