Penetration Testing Manager (Sr. Manager InfoSec) - Remote

First Citizens Bank•Raleigh, NC

6d•Remote

About The Position

The AppSec Pentest Manager leads a team of penetration testers in First Citizens Bank’s Application Security Testing Program and partners strategically with application development and IT teams. The role requires deep knowledge of penetration testing processes and methodologies, including the OWASP Top 10, Penetration Testing Execution Standard (PETS), and CREST Pentesting Methodologies. The manager leads the team in identifying, classifying, and reporting complex vulnerabilities in the bank’s custom applications. This leader develops penetration testing strategy aligned with the broader AppSec and Vulnerability Management Strategy, the SDLC, and the bank’s risk appetite. The position establishes testing schedules and cadence, oversees program execution and staff development, provides technical advice on testing and remediation, manages vendors and procurement of tools and services, and reports metrics and risks to audiences ranging from team members to senior executives. The position is remote eligible.

Requirements

Bachelor’s degree and 8 years of experience, or a high school diploma or GED/equivalent and 12 years of experience, in information security or technology.
Deep knowledge of penetration testing processes, including the OWASP Top 10, Penetration Testing Execution Standard (PETS), and CREST Pentesting Methodologies.
Expert skill in penetration testing strategy development and program management.
Ability to communicate risk effectively to audiences with varying levels of technical detail.

Nice To Haves

At least one industry-standard certification related to penetration testing and/or cybersecurity leadership, such as CISSP, CISM, GPEN, GWAPT, OSCP, or OSWA.
Experience with agentic pentesting.

Responsibilities

Develop penetration testing strategy integrated with the AppSec and Vulnerability Management Strategy, SDLC, and First Citizens Bank’s risk appetite.
Establish a regular penetration testing cadence aligned with the bank’s Cyber Security Standards.
Identify improvement opportunities for the penetration testing team and drive improvement projects to completion.
Establish testing schedules and coordinate multiple inputs and teams; identify and remediate schedule slippages, and reprioritize when urgent needs arise.
Set and monitor expectations to achieve company and department goals.
Manage assigned staff performance, training, and evaluation, and create development plans to maintain their skillsets.
Manage vendors and procure tools and services.
Provide internal team members with expert technical advice on penetration testing methodology.
Advise internal clients on the impact of penetration testing findings and remediation recommendations.
Partner with application teams to drive closure of penetration testing findings.
Work with application teams, BISOs, GRC, and IT teams to ensure exceptions are documented appropriately and align with the bank’s risk appetite.
Regularly report metrics, analyze data from various sources, and identify business insights, trends, or issues.
Communicate risk appropriately to varied audiences, including C-level executives, and clearly articulate risks and issues to the direct supervisor.