Senior Mainframe and Web Application Security Engineer – Senior Penetration Tester

🔥 3 minutes ago

🌲 North Carolina, Virginia – Remote

🌲 North Carolina – Remote ⚔️ Virginia – Remote

💵 $140k - $180k / year

⏰ Full Time

🟠 Senior

💻 Application Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Truist

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 2019

🏦 Banking

💸 Finance

🤝 B2B

Banking • Finance • B2B

Truist is a financial institution that offers a wide range of banking services, focusing on branch banking, commercial banking, corporate and institutional banking, and mortgage and consumer lending. The company emphasizes a culture of care, diversity, and inclusion, striving to make a positive impact in clients' lives and the community. Truist provides various career opportunities and values employee growth, offering comprehensive benefits and resources for well-being. With a commitment to diversity and workplace equity, Truist has received numerous accolades for its employment practices, including recognition for diversity and inclusion efforts.

📋 Description

• Perform advanced penetration testing and security assessments across enterprise technologies, primarily mainframe environments • Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS environments • Assess USS, RACF, ACF2, Top Secret, CICS, IMS, Db2, MQ, JCL, JES2, TSO/ISPF, TN3270, FTP, z/OS Connect, REST APIs, and NJE • Use manual techniques, custom scripting, and offensive tooling to enumerate users and resources, map datasets, access unprotected spool and job output, and exploit misconfigurations and insecure interfaces • Evaluate exploitability and business impact and determine finding severity and risk • Document findings with reproduction steps, evidence, impact statements, and remediation recommendations • Present and defend technical findings to application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders • Perform validation and retesting to confirm remediation and risk reduction • Maintain testing evidence supporting audit, regulatory, and compliance requirements including PCI DSS and SOX • Partner with internal and external testing teams to improve testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes • Perform peer reviews of penetration testing reports and provide technical guidance and mentorship • Maintain current knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats

🎯 Requirements

• Bachelor’s degree or equivalent education, training, and work-related experience • Minimum of 7 years of experience in security engineering or related cybersecurity roles • Deep specialized knowledge in cybersecurity principles, theories, and concepts • Proven experience in software development lifecycle security practices • Deep knowledge of threat modeling, security testing, and penetration testing • Experience implementing and managing complex information security technologies • Five or more years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience • Hands-on experience assessing mainframe environments, including z/OS and common security components such as RACF, ACF2, or Top Secret • Knowledge of mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening • Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments • Strong technical writing and communication skills, including the ability to explain and defend technical findings to technical and non-technical audiences • Ability to independently manage multiple testing engagements, adjust approach as priorities and requirements evolve, and drive work to completion • Experience developing scripts, automation, or AI-enabled tooling that streamlines testing activities and improves the efficiency of repeatable processes • Experience in banking, financial services, or another highly regulated industry • Relevant offensive security certifications, such as OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials • English language fluency required • Must not require employer sponsorship for work visa status or employment authorization

🏖️ Benefits

• Medical insurance • Dental insurance • Vision insurance • Life insurance • Disability insurance • Accidental death and dismemberment coverage • Tax-preferred savings accounts • 401k plan • No less than 10 days of vacation during the first year of employment • 10 sick days • Paid holidays • Defined benefit pension plan may be available depending on position and division • Restricted stock units may be available depending on position and division • Deferred compensation plan may be available depending on position and division