Z/os Security Engineer Jobs

1 job found

Today

Mainframe and Web Application Security Senior Engineer - Senior Penetration Tester

Information Technology Senior Management Forum Charlotte, NC

Charlotte, NC

Today

$140k - $180k/yr Full time Senior Cics Security Cybersecurity Tools

Apply Now

Job Description

Lead penetration testing efforts for enterprise z/OS and mainframe-connected services, covering end-to-end security validation and evidence-backed reporting.

Responsibilities

Conduct black box, grey box, and assumed breach penetration tests across enterprise z/OS environments
Test security-relevant areas including USS (Unix System Services), external security manager subsystems (RACF, ACF2, Top Secret), and application/batch components
Assess transactional and application workloads including CICS, IMS, and db2, plus messaging via MQ
Evaluate batch execution flows including JCL and JES2, and interactive access via TSO/ISPF
Test network-facing services such as TN3270, FTP, Z/OS Connect, Rest APIs, and NJE
Use manual methods plus custom scripting and offensive tooling (including REXX, JCL, Assembler, and Python) to enumerate users/resources and map datasets
Attempt to access unprotected spool and job output and pursue exploit paths such as misconfigured CICS transactions and insecure interfaces
Evaluate exploitability and business impact to determine finding severity and risk using sound judgment
Produce documentation that includes reproduction steps, supporting evidence, impact statements, and practical remediation recommendations
Present and defend findings with application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders
Validate remediation through retesting to confirm risk reduction and maintain testing evidence for audit, regulatory, and compliance requirements (including PCI DSS and SOX)
Partner with internal and external testing teams to improve mainframe testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes
Perform peer reviews of penetration testing reports and provide technical guidance and mentorship
Maintain up-to-date knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats

Requirements

Bachelor’s degree or equivalent education, training, and work-related experience
Minimum 7 years of experience in security engineering or related cybersecurity roles
Deep specialized knowledge of cybersecurity principles, theories, and concepts
Proven experience with security practices across the software development lifecycle
Deep knowledge of threat modeling, security testing, and penetration testing
Experience implementing and managing complex information security technologies

Technologies

z/OS
USS (Unix System Services)
RACF, ACF2, Top Secret
CICS, IMS, db2, MQ
JCL, JES2, TSO/ISPF
TN3270, FTP, Z/OS Connect, Rest APIs, NJE
REXX, Assembler, Python
PCI DSS, SOX
OSCP, OSEP, OSWE, GPEN, GXPN

Benefits

Medical, dental, and vision insurance
Life insurance and disability insurance
Accidental death and dismemberment coverage
Tax-preferred savings accounts
401k plan
No less than 10 days of vacation (prorated based on hire date and full-time or part-time status) during the first year of employment
10 sick days (also prorated)
Paid holidays
Defined benefit pension plan (depending on position and division)
Restricted stock units (depending on position and division)
Deferred compensation plan (depending on position and division)

Preferred Qualifications

5+ years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience
Hands-on experience assessing mainframe environments, including z/OS and common security components such as RACF, ACF2, or Top Secret
Knowledge of mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening
Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments
Strong technical writing and communication skills, including ability to explain and defend findings to technical and non-technical audiences
Ability to independently manage multiple testing engagements, adjust priorities as requirements evolve, and drive work to completion
Experience developing scripts, automation, or AI-enabled tooling to streamline testing and improve repeatable process efficiency
Experience in banking, financial services, or another highly regulated industry
Relevant offensive security certifications: OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials

Location: Charlotte, NC (onsite)

Salary: USD 140,000 - 180,000 per year

Employment Type: Full-time

Benefits Eligibility Note: All regular teammates working 20 hours or more per week are eligible for benefits, though specific coverage may vary by division.

View full job page →

Get Z/os Security Engineer Jobs alerts

New Z/os Security Engineer Jobs, daily.