Mainframe and Web Application Security Senior Engineer - Senior Penetration Tester

Lead penetration testing efforts for enterprise z/OS and mainframe-connected services, covering end-to-end security validation and evidence-backed reporting.

Responsibilities

• Conduct black box, grey box, and assumed breach penetration tests across enterprise z/OS environments
• Test security-relevant areas including USS (Unix System Services), external security manager subsystems (RACF, ACF2, Top Secret), and application/batch components
• Assess transactional and application workloads including CICS, IMS, and db2, plus messaging via MQ
• Evaluate batch execution flows including JCL and JES2, and interactive access via TSO/ISPF
• Test network-facing services such as TN3270, FTP, Z/OS Connect, Rest APIs, and NJE
• Use manual methods plus custom scripting and offensive tooling (including REXX, JCL, Assembler, and Python) to enumerate users/resources and map datasets
• Attempt to access unprotected spool and job output and pursue exploit paths such as misconfigured CICS transactions and insecure interfaces
• Evaluate exploitability and business impact to determine finding severity and risk using sound judgment
• Produce documentation that includes reproduction steps, supporting evidence, impact statements, and practical remediation recommendations
• Present and defend findings with application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders
• Validate remediation through retesting to confirm risk reduction and maintain testing evidence for audit, regulatory, and compliance requirements (including PCI DSS and SOX)
• Partner with internal and external testing teams to improve mainframe testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes
• Perform peer reviews of penetration testing reports and provide technical guidance and mentorship
• Maintain up-to-date knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats

Requirements

• Bachelor’s degree or equivalent education, training, and work-related experience
• Minimum 7 years of experience in security engineering or related cybersecurity roles
• Deep specialized knowledge of cybersecurity principles, theories, and concepts
• Proven experience with security practices across the software development lifecycle
• Deep knowledge of threat modeling, security testing, and penetration testing
• Experience implementing and managing complex information security technologies

Technologies

• z/OS
• USS (Unix System Services)
• RACF, ACF2, Top Secret
• CICS, IMS, db2, MQ
• JCL, JES2, TSO/ISPF
• TN3270, FTP, Z/OS Connect, Rest APIs, NJE
• REXX, Assembler, Python
• PCI DSS, SOX
• OSCP, OSEP, OSWE, GPEN, GXPN

Benefits

• Medical, dental, and vision insurance
• Life insurance and disability insurance
• Accidental death and dismemberment coverage
• Tax-preferred savings accounts
• 401k plan
• No less than 10 days of vacation (prorated based on hire date and full-time or part-time status) during the first year of employment
• 10 sick days (also prorated)
• Paid holidays
• Defined benefit pension plan (depending on position and division)
• Restricted stock units (depending on position and division)
• Deferred compensation plan (depending on position and division)

Preferred Qualifications

• 5+ years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience
• Hands-on experience assessing mainframe environments, including z/OS and common security components such as RACF, ACF2, or Top Secret
• Knowledge of mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening
• Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments
• Strong technical writing and communication skills, including ability to explain and defend findings to technical and non-technical audiences
• Ability to independently manage multiple testing engagements, adjust priorities as requirements evolve, and drive work to completion
• Experience developing scripts, automation, or AI-enabled tooling to streamline testing and improve repeatable process efficiency
• Experience in banking, financial services, or another highly regulated industry
• Relevant offensive security certifications: OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials

Location: Charlotte, NC (onsite)

Salary: USD 140,000 - 180,000 per year

Employment Type: Full-time

Benefits Eligibility Note: All regular teammates working 20 hours or more per week are eligible for benefits, though specific coverage may vary by division.