Penetration Testing Analyst, Vice President

State Street•Quincy, MA

13d

About The Position

State Street is seeking a Vice President, Penetration Testing Analyst, for its Threat Intelligence and Assurance organization. This is a senior, hands-on technical role that serves as the team’s in-house technical authority for complex penetration testing engagements and remediation validation. The role leads scenario-based testing of high-value systems and services, owns validation of fixes, and helps mature a repeatable, high-quality internal testing capability. It partners with finding owners, offensive security teams, external testing providers, security operations, and risk and regulatory partners to ensure testing is realistic, findings are technically sound, and remediation withstands real-world attack conditions. The position is accountable for the technical defensibility of closure decisions presented to senior leadership and Lines of Defense. The role provides technical leadership across the full engagement lifecycle, challenges external provider results, directs remediation planning and validation, and makes evidence-based closure recommendations. It also leads targeted TTP assessments and purple team exercises, communicates outcomes to leadership and governance forums, contributes offensive security expertise to partner teams, and mentors team members and partners. The stated annual salary range is $120,000–$202,500 for the primary location; the applicable range may differ for other locations. Employees may participate in State Street’s benefits program, which includes a 401(k) with company match, insurance coverage, paid time off, an Employee Assistance Program, incentive compensation eligibility, and certain tax-advantaged savings plans. The company also describes inclusive development opportunities, flexible work-life support, paid volunteer days, and employee networks.

Requirements

Extensive hands-on offensive security experience, such as advanced penetration testing, red teaming, or adversary simulation.
Expert practical knowledge of Active Directory and Entra ID attack paths, privilege escalation, lateral movement, credential abuse, EDR evasion, and cloud attack techniques across Azure and AWS.
Advanced proficiency with offensive tools and command-and-control frameworks, such as Cobalt Strike, BloodHound, Mimikatz, Metasploit, and Kali Linux.
Scripting ability for custom tooling and automation using Python, PowerShell, or similar.
Proven experience leading remediation validation for complex findings, including defining closure criteria and determining whether controls work in practice.
Deep working knowledge of MITRE ATT&CK, scenario-based test design, and measurement of detection and response capabilities during testing.
Experience directing and challenging third-party testing providers and distinguishing exploitable risk from theoretical findings.
Executive-level written and verbal communication skills, including the ability to defend technical conclusions to senior leaders, governance bodies, and independent reviewers.
Discretion and sound judgment when handling sensitive, confidential engagement information.
Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
10 or more years of related experience.

Nice To Haves

Industry-recognized offensive security certification such as OSCP, OSEP, OSCE3, CRTO, GXPN, or equivalent.
Experience supporting large-scale remediation validation programs.

Responsibilities

Serve as senior technical lead throughout engagement scoping, test planning, rules of engagement, execution oversight, and post-test remediation planning.
Provide real-time technical guidance during engagements, assess tester activity and operational risk, and guide escalation decisions.
Challenge external testing providers’ attack paths, evidence quality, severity ratings, and MITRE ATT&CK mapping.
Coordinate with finding owners and engineering teams to translate findings into technical remediation requirements and measurable validation criteria.
Lead remediation-validation strategy, including grouping related findings, defining test criteria and expected outcomes, and personally retesting fixes against original and alternative attack paths.
Assess remediation across the wider estate, including variant attack paths, implementation consistency, and exposure introduced by the fix.
Make technical closure recommendations and produce evidence-based reporting that identifies findings as closed, open, or partially closed, with executive summaries for senior and non-technical audiences.
Present testing and validation outcomes to senior leadership and governance forums, and defend the technical basis for findings, residual risk, and closure decisions.
Design and lead targeted TTP assessments and collaborative purple team exercises to validate detection, response, and preventive controls.
Communicate detection and control gaps to Detection Engineering, Assurance, and Security Operations, and track improvements through validation.
Provide offensive security support to partner teams, including risk and regulatory functions.
Help define methods, test plans, evidence standards, and lessons-learned practices to mature the internal testing capability.
Mentor team members and partners.

Benefits

401(k) retirement savings plan with company match.
Insurance coverage including basic life, medical, dental, vision, long-term disability, and optional additional coverages.
Paid time off, including vacation, sick leave, short-term disability, and family-care responsibilities.
Access to an Employee Assistance Program.
Eligibility for annual performance-based incentive awards, with certain sales-role exceptions.
Eligibility for certain tax-advantaged savings plans.
Inclusive development opportunities.
Flexible work-life support.
Paid volunteer days.
Employee networks.