Security Engineer, Penetration Testing

ISC2 is the world’s leading nonprofit member organization for cybersecurity professionals, dedicated to creating a safe and secure cyber world. The Security Engineer, Penetration Testing will execute offensive security assessments and build defensive engineering controls to enhance ISC2’s security posture, collaborating closely with various teams to implement security measures and support compliance programs.

Responsibilities:

• Plan, execute, and document internal and external penetration tests against ISC2 applications, networks, cloud environments, and infrastructure
• Perform vulnerability assessments and validate findings to distinguish genuine risks from false positives
• Conduct web application, API, mobile, and network vulnerability assessments using industry-standard methodologies (OWASP, PTES, OSSTMM)
• Perform social engineering assessments, including phishing simulations and physical security testing as authorized
• Produce clear, actionable written reports detailing findings, risk ratings, evidence, and remediation recommendations tailored to both technical and executive audiences
• Support red team exercises and adversary simulation activities to test detection and response capabilities
• Develop and maintain the penetration testing program, including scope definitions, rules of engagement, and testing schedules. Move towards a continuous test mindset and method
• Coordinate with third-party security vendors for external assessments and bug bounty program management where applicable
• Own remediation follow-through: translate pen test findings into security engineering work items, validate fixes, and track resolution to closure in Jira Service Management
• Design and implement security controls across ISC2’s cloud and on-premises environments, including hardening configurations for Azure, Okta, SentinelOne, CheckPoint, and F5 XD
• Participate in security architecture and design reviews for new systems, integrations, and third-party products; provide security requirements and risk acceptance recommendations
• Develop and maintain security automation scripts and tooling to improve detection coverage, reduce manual effort in assessment workflows, and support continuous monitoring
• Support the Secure Software Development Lifecycle (SSDLC), including security requirements definition, code review support, and pre-deployment security validation
• Maintain awareness of emerging vulnerabilities, exploits, and threat actor TTPs; operationalize threat intelligence into actionable hardening and detection improvements
• Support ISC2’s ISO/IEC 27001:2022 ISMS by providing technical evidence and input for Annex A controls spanning vulnerability management (A.8.8), secure development (A.8.25–A.8.29), and technical review (A.8.29)
• Miscellaneous duties as assigned

Requirements:

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field. Will consider candidates with a high school diploma and at least eight (8) years of experience in cybersecurity
• 4+ years of experience in cybersecurity, with a demonstrable mix of offensive security (penetration testing) and defensive/engineering work (control implementation, architecture review, or SSDLC)
• Experience with IAM security, including Okta and SAML/OAuth-based environments, both for testing and hardening purposes
• Security engineering experience implementing and hardening controls across cloud and identity platforms (Azure, Okta, SentinelOne, endpoint security tooling)
• Ability to travel up to 5% of the time
• Work normal business hours and extended hours when necessary
• Remain in a stationary position, often standing or sitting, for prolonged periods
• The role requires the ability to work at a computer for extended periods and communicate effectively through written and verbal channels
• Regular use of office equipment such as a computer/laptop and monitor computer screens
• Dexterity of hands and fingers to operate a computer keyboard, mouse, and other computer components
• Proficiency with penetration testing tools including Burp Suite, Metasploit, Nmap, Nessus, Cobalt Strike, and similar offensive frameworks
• Strong understanding of web application vulnerabilities (OWASP Top 10), network protocols, Active Directory attack paths, and cloud security (Azure, AWS, GCP)
• Effective written and verbal communication with cross-functional teams is essential
• Scripting and automation proficiency in Python, Bash, or PowerShell; ability to write or modify exploit code as well as defensive tooling
• Familiarity with MITRE ATT&CK, CVSS, CVE, NIST SP 800-115, and the CIS Benchmarks for secure configuration baselines
• Posess AI literacy and ability to test Ai workloads and infrastructures
• Integrity & Ethics: Operates with the highest standard of professional ethics; treats privileged access, sensitive findings, and organizational data with strict confidentiality
• Analytical Thinking: Applies a structured, adversarial mindset to both offensive assessments and defensive design; bridges exploit research with practical engineering solutions
• Communication: Clearly articulates complex technical vulnerabilities and risk in written reports and verbal briefings to both technical and non-technical stakeholders
• Collaboration: Partners effectively with developers, architects, and operations staff to drive meaningful security improvements without disrupting business operations
• Continuous Learning: Actively pursues knowledge of emerging threats, tools, and techniques; contributes insights to team knowledge sharing
• Relevant certifications strongly preferred: OSCP, GPEN or GWAPT, plus one engineering/architecture credential (CISSP, CSSLP, or equivalent)
• ISC2 membership or certifications (CISSP, CC) are a plus and demonstrate alignment with ISC2's mission
• Experience supporting ISO/IEC 27001, SOC 2, PCI-DSS, or similar compliance programs is a plus