Penetration Testing Analyst, Vice President
About The Position
State Street is seeking a Vice President, Penetration Testing Analyst, to join its Threat Intelligence and Assurance organization. This is a senior, hands-on technical position serving as the team’s in-house technical authority for complex penetration testing engagements and remediation validation. The role leads scenario-based testing of high-value systems and services, ensures findings are technically sound, and validates that fixes withstand realistic attack conditions. It works with finding owners, offensive security partners, external testing providers, security operations, and risk and regulatory partners, and is accountable for the technical defensibility of closure decisions presented to senior leadership and the Lines of Defense. The position also helps mature a repeatable, high-quality internal testing capability. The analyst leads the technical execution of engagements from scoping and planning through execution oversight and remediation planning. They guide engagement activity and escalation decisions, challenge external providers’ attack paths and evidence, coordinate actionable remediation requirements with engineering teams, and lead evidence-based validation and closure recommendations. The role also designs targeted TTP assessments and purple team exercises, communicates findings and outcomes to leadership and governance forums, supports partner teams, and mentors team members and partners.
Requirements
- Extensive hands-on offensive security experience, such as advanced penetration testing, red teaming, or adversary simulation.
- Expert-level practical knowledge of Active Directory and Entra ID attack paths, privilege escalation, lateral movement, credential abuse, EDR evasion, and cloud attack techniques across Azure and AWS.
- Advanced proficiency with offensive tooling and C2 frameworks, such as Cobalt Strike, BloodHound, Mimikatz, Metasploit, and Kali Linux.
- Scripting ability for custom tooling and automation using Python, PowerShell, or similar.
- A proven record of leading remediation validation for complex findings, including defining closure criteria and determining whether controls work in practice.
- Deep working knowledge of MITRE ATT&CK, scenario-based test design, and measurement of detection and response capabilities during testing.
- Experience directing and challenging third-party testing providers, with judgment to distinguish exploitable risk from theoretical findings.
- Executive-level written and verbal communication skills, including the ability to defend technical conclusions to senior leadership, governance bodies, and independent reviewers.
- Discretion and sound judgment when handling sensitive, confidential engagement information.
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
- 10 or more years of related experience.
Nice To Haves
- Experience in financial services or another highly regulated industry.
- Industry-recognized offensive security certifications such as OSCP, OSEP, OSCE3, CRTO, GXPN, or equivalent.
- Experience supporting large-scale remediation validation programs.
Responsibilities
- Serve as senior technical lead throughout the engagement lifecycle, including scoping, test planning, rules of engagement, execution oversight, and post-test remediation planning.
- Provide real-time technical guidance during engagements by assessing tester activity, judging operational risk, and guiding escalation decisions.
- Challenge external testing providers’ attack paths, evidence quality, severity ratings, and MITRE ATT&CK mapping.
- Coordinate with finding owners and engineering teams to translate findings into technical remediation requirements and measurable validation criteria.
- Lead remediation validation strategy, including grouping related findings, defining test criteria and expected outcomes, and retesting fixes against original and alternative attack paths.
- Assess remediation across the wider estate, including variant attack paths, consistency of implementation, and exposure introduced by the fix.
- Make technical closure recommendations and prepare evidence-based reporting that classifies findings as closed, open, or partially closed, including executive summaries for senior and non-technical audiences.
- Present testing and validation outcomes to senior leadership and governance forums, and defend the technical basis for findings, residual risk, and closure decisions.
- Design and lead targeted TTP assessments and collaborative purple team exercises to validate detection, response, and preventive controls.
- Share detection and control gaps with Detection Engineering, Assurance, and Security Operations, and track resulting improvements through validation.
- Provide offensive security support to partner teams, including risk and regulatory functions.
- Help establish methods, test plans, evidence standards, and lessons-learned practices to mature the internal testing capability.
- Mentor team members and partners.
Benefits
- 401(k) retirement savings plan with company match.
- Basic life insurance, medical insurance, dental insurance, vision insurance, long-term disability coverage, and other optional coverages.
- Paid time off, including vacation, sick leave, short-term disability, and leave for family care responsibilities.
- Access to an Employee Assistance Program.
- Incentive compensation, including eligibility for annual performance-based awards, subject to stated exclusions.
- Eligibility for certain tax-advantaged savings plans.
- Inclusive development opportunities.
- Flexible work-life support.
- Paid volunteer days.
- Employee networks.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
