Cloud Security Penetration Tester

Vanguard • Malvern, PA

2d • Hybrid

About The Position

The Cloud Security Penetration Tester plans, leads, and conducts penetration tests across multi-cloud environments and cloud-hosted applications. The role uses manual and automated testing to identify and validate vulnerabilities, misconfigurations, IAM weaknesses, privilege-escalation paths, insecure trust relationships, and cloud attack paths.

The position leads assessment reporting and presents findings to technical teams and leadership. It collaborates with IT subdivisions, third-party partners, and business units to assess how technology implementations affect IT and business operations. The role also advances cloud penetration testing methodologies, tooling, automation, standards, and best practices; researches emerging cloud vulnerabilities and offensive techniques; and evaluates and onboards tools or develops custom tools as needed.

Vanguard uses a hybrid working model for the majority of its crew members, combining flexibility with in-person learning, collaboration, and connection. The company states that it is not offering visa sponsorship for this position.

Requirements

• At least ten years of related work experience, including at least three years in information security.
• An undergraduate degree in a related field or an equivalent combination of training and experience.
• Hands-on experience performing penetration testing or offensive security assessments across multiple cloud platforms.
• Experience performing cloud, web application, and API penetration testing using tools such as Burp Suite, Pacu, Redboto, CloudBrute, ScoutSuite, and Prowler.
• Ability to clearly document and communicate technical vulnerabilities, exploitation scenarios, business impact, and remediation recommendations.

Nice To Haves

• Preferred industry security certifications, such as GIAC Cloud Penetration Tester (GCPN), OffSec Certified Professional (OSCP), GIAC Penetration Tester (GPEN), OffSec Web Assessor (OSWA), OffSec Web Expert (OSWE), or GIAC Web Application Penetration Tester (GWAPT).

Responsibilities

• Plan, lead, and conduct penetration tests across multi-cloud environments and cloud-hosted applications.
• Perform manual and automated testing to identify and validate vulnerabilities, misconfigurations, IAM weaknesses, privilege-escalation paths, insecure trust relationships, and cloud attack paths.
• Develop detailed assessment reports and present findings to technical teams and leadership.
• Lead reporting and collaborate with IT subdivisions, third-party partners, and business units to identify the impact of technology implementations on IT and business operations.
• Lead the evolution of cloud penetration testing methodologies, tooling, automation, standards, and best practices.
• Maintain subject matter expertise and research emerging cloud vulnerabilities, attack techniques, and offensive security tooling.
• Lead evaluation and onboarding of new tooling, and develop custom tools as needed.
• Participate in special projects and perform other duties as assigned.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior