Lead, Penetration Tester

Humana

5d • $142,300 - $195,700 • Remote

About The Position

We're hiring the technical leader of our penetration testing practice, a hands-on Lead who sets how we test, raises the bar across the team, and moves us into AI-augmented offensive security. You will not manage people. You will own the craft: the methods, the standards, the hardest engagements, and the adoption of agentic AI tooling that makes the whole team faster and sharper. You'll work alongside (not under) our Associate Director, who leads the people while you lead the testing. This is a 100% remote role on a specialized offensive-security team, penetration testing shoulder-to-shoulder with Red Team, Breach & Attack Simulation, and Bug Bounty. Fridays are for research and development. You'll have Hack The Box Pro Labs and role-based paths, discretionary certification funding, and a conference/training budget.

Requirements

• 7+ years in penetration testing, ethical hacking, or offensive security operations, with ~2 years leading complex testing programs or technical workstreams (setting methods others follow, not necessarily managing people).
• Depth across the modern attack surface, web apps, APIs, cloud (AWS/Azure/GCP), and Active Directory / Entra ID, with a track record leading the most complex assessments autonomously.
• You've attacked AI, hands-on testing of AI/LLM-powered applications (prompt injection, jailbreaks, adversarial techniques), or demonstrated ability to secure emerging AI systems. We care about what you've done, not years on a framework that's only a few years old.
• You operate agentic AI tooling, or you're eager to. You've used modern AI-assisted or agentic offensive tooling in real engagements and can judge where it helps and where it doesn't, or you're a strong tester ready to adopt it and lead a team's move toward it. Either way, you're excited to mature the practice toward AI-augmented testing.
• You set the standard, you've owned a testing methodology, playbook, or quality bar that other practitioners worked from, and you can translate deep technical findings into clear business risk for executives.
• Work at Home Requirements: At minimum, a download speed of 25 Mbps and an upload speed of 10 Mbps is required; wireless, wired cable or DSL connection is suggested. Work from a dedicated space lacking ongoing interruptions to protect member PHI / HIPAA information.

Nice To Haves

• Certifications are a plus, not a gate, e.g. OSCP, OSWE, OSCE3, CPTS, CWEE, or equivalent advanced credentials.
• Building or extending offensive tooling, scripting (Python/PowerShell/Bash/Ruby), custom exploit development, or contributing requirements to agentic AI tooling (multi-agent orchestration, MCP servers, LLM-as-judge) built by the AI-engineering team.
• Deeper adversarial ML, model extraction/inversion, membership inference, data/supply-chain poisoning, and hands-on with PyRIT or Garak.
• Application-security research and exploit development; mobile (iOS/Android); published research or conference talks (DEF CON, Black Hat, BSides).
• Security automation, CI/CD pipeline security testing, and DevSecOps practices.

Responsibilities

• Set and govern the team's testing methodology, playbooks, and evidence-quality bar; standardize how complex assessments are scoped, executed, and reported.
• Lead the most complex penetration tests (web apps, APIs, cloud, AD/Entra ID, AI/LLM applications) with full autonomy, and mentor other testers on technique, without being their manager.
• Operate and mature the team's agentic AI offensive tooling: apply it to improve test coverage, triage, and evidence quality; evaluate AI-assisted findings for accuracy, exploitability, and business risk; and feed practitioner requirements back to the Offensive AI Engineering team who build the platform.
• Test AI systems: lead adversarial assessments of AI/LLM applications, prompt injection (direct/indirect), jailbreaks, and adversarial techniques, mapped to the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.
• Influence the functional strategy: identify gaps in testing coverage and organizational controls, propose new assessment approaches for emerging threats, and shape where the practice invests.
• Translate technical findings into business risk for technical and executive stakeholders; lead closing meetings with application owners, security teams, and internal customers.
• Support PCI-DSS and other compliance-driven testing obligations at the standard the program requires.

Benefits

• Hack The Box Pro Labs
• discretionary certification funding
• conference/training budget
• medical
• dental
• vision benefits
• 401(k) retirement savings plan
• time off (including paid time off, company and personal holidays, paid parental and caregiver leave)
• short-term and long-term disability
• life insurance

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed