Pentesting Engineer

Bechtel Corporation • Glendale, CA

2d • Remote

About The Position

Bechtel is refreshing its Continuous Threat Exposure Management (CTEM) and internal penetration-testing capabilities. The program combines an agentic CTEM platform for discovering, contextualizing, prioritizing, validating, and driving remediation of enterprise exposure; an agentic red-teaming platform that orchestrates autonomous attacker agents; and human-led exploitation work. AI agents perform continuous discovery, correlation, enrichment, prioritization, and repeatable attack execution. Engineers focus on complex, context-dependent work, including business logic flaws, chained vulnerabilities, social engineering, novel attack paths, and attacks against AI systems such as prompt injection, agent tool abuse, and MCP interface exploitation.

This hands-on build-and-break role is intended for someone early in their security career. Under the direction of senior testers, the engineer finds, validates, and exploits vulnerabilities in traditional and AI-based systems and supports development and operation of autonomous red-team agents. The role includes steering multi-agent campaigns, validating AI-generated findings against real-world exploitability, and performing nuanced exploitation that AI tools do not reliably handle. The position uses commercial and open-source offensive security tools, CTEM-stack tooling, emerging agentic tools, and internal platforms. Prior familiarity with specific tools is not required; the ability to learn new tools quickly is important.

Requirements

• Typically requires a bachelor's degree in Cybersecurity, Computer Science, Information Systems, Electrical/Computer Engineering, or a closely related field and 8+ years of relevant experience, or equivalent demonstrated experience through CTF participation, bug bounty contributions, self-directed security education, or a relevant junior security role.
• 0–2 years of hands-on experience in cybersecurity, penetration testing, vulnerability or exposure management, security operations, or equivalent practical security training; university hires with strong self-directed learning portfolios may be considered on par with formal experience.
• Knowledge of TCP/IP, DNS, HTTP/S, and common enterprise identity and directory protocols.
• Understanding of cryptography fundamentals, including symmetric and asymmetric encryption, hashing, PKI, common weaknesses, and misuse patterns.
• Knowledge of web technologies, including HTTP, cookies and sessions, authentication and session management fundamentals, OWASP Top 10, and the OWASP Testing Guide.
• Ability to triage scanner output, prioritize findings, and assess exploitability and business impact; familiarity with CVSS and awareness of EPSS and CISA KEV.
• Understanding of core compute, storage, identity, and networking concepts in at least one major cloud platform: AWS, Azure, or GCP.
• Proficiency with the Linux command line and familiarity with Windows and Active Directory fundamentals.
• Proficiency in Python or Bash for automation, REST API use, processing scanner and log data, and building small tools.
• Comfort joining, deduplicating, and reasoning over findings and asset data from multiple sources.
• Ability to manually exploit vulnerabilities in a controlled lab, beyond running scanners and reading their output.
• Comfort reading, extending, and debugging software systems used for automated discovery and testing, including agent workflows, integrations, state, and failure modes.
• Practical exposure to multi-agent orchestration, such as running a coding or security agent on a real task, chaining agents or tools, and recognizing orchestration failures.
• Ability to critically assess AI-generated exploit code, vulnerability analyses, prioritization decisions, and agent actions; identify misread evidence or overclaimed findings; and judge when human review is needed.
• Demonstrated adversarial thinking and ability to identify attack paths not obvious from documentation.
• Clear technical writing and ability to document findings and reproduction steps and communicate risk to technical and non-technical audiences.
• Ability to collaborate across teams and work findings to closure with infrastructure, cloud, application, and business-unit owners.
• Track record of self-directed learning, comfort with ambiguity, and ability to learn new tools.

Nice To Haves

• Hands-on exposure or vulnerability management, including enterprise vulnerability scanning, remediation tracking, or risk-based prioritization.
• Experience with CNAPP or cloud posture tools, CIEM, container/Kubernetes security, or IaC scanning.
• Experience with external attack surface discovery, asset attribution, or shadow IT identification.
• Experience with CMDB or ITSM platforms, asset reconciliation, or asset data quality work.
• Experience in third-party or supply-chain risk, vendor risk assessment, SBOM analysis, or dependency/component vulnerability management.
• Experience building API integrations, data pipelines, or workflow automation across security tools.
• Exploit development fundamentals, including buffer overflows, use-after-free, format strings, ASLR/DEP, and memory management concepts sufficient to evaluate exploit validity.
• Knowledge of enterprise identity and directory attack surfaces, credential attacks, and Linux and Windows privilege escalation pathways.
• Knowledge of OAuth 2.0/OIDC, SAML, and JWT flows and common misconfigurations.
• Cloud security assessment experience, including IAM misconfigurations and privilege escalation paths across AWS, Azure, or GCP.
• Participation in red or purple team exercises or experience with breach-and-attack-simulation tools.
• CTF experience, such as HackTheBox, TryHackMe, PicoCTF, or CTFtime-ranked competitions, with demonstrated progression and write-ups showing independent problem-solving.
• Valid bug bounty submissions through HackerOne, Bugcrowd, or Intigriti; logic flaws, authentication bypass, and novel techniques are preferred over scanner-found issues.
• Certifications held or in active pursuit: eJPT, OSCP, CRTO, BSCP, CompTIA Security+, or a cloud security certification.
• Experience using LLMs for exploit development, analysis, or automation, or building or operating agentic tools such as coding agents, multi-agent workflows, or MCP servers for offensive or defensive tasks.
• Cloud certification such as AWS Cloud Practitioner, Azure Fundamentals, or equivalent.
• A home lab for practicing exploitation, running CTF challenges, or experimenting with security tools.
• Open-source contributions involving security tooling, exploit development, or vulnerability research on GitHub.

Responsibilities

• Execute hands-on penetration tests of web applications, networks, cloud environments, and AI-based systems under the direction of senior penetration testers.
• Support development and operation of autonomous red-team agents, help steer multi-agent campaigns, and validate AI-generated findings against real-world exploitability.
• Test and validate security controls that maintain the confidentiality, integrity, and availability of information systems.
• Identify and prioritize threats to critical business assets and infrastructure, and provide stakeholders with practical mitigation recommendations.
• Assist with security assessments covering network traffic, firewalls, identity and directory services, and network access.
• Triage scanner, tooling, and agent output; reproduce findings; evaluate exploitability and business impact; and document clear reproduction steps.
• Assist in turning test findings and requirements into end-to-end solutions that account for technical, schedule, and cost constraints.
• Help align security testing coverage with business requirements and emerging threats.
• Support risk assessments of applications and infrastructure and contribute findings-based recommendations to application and platform owners.
• Participate in computer incident response team efforts and support investigations of cybersecurity incidents.
• Research current offensive security techniques, tools, and threat actor tradecraft, and share findings with the team.
• Perform complex, context-dependent exploitation work, including business logic flaws, social engineering, chained vulnerabilities, novel attack vectors, and attacks on AI systems.

Benefits

• Bechtel states that it offers robust benefits and time to recharge, and refers applicants to its Total Rewards information; specific benefits are not listed in the posting.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level