Senior Cyber Security Application Penetration Testing Engineer

Wells Fargo•Irving, TX

1d•$100,000 - $196,000•Hybrid

About The Position

Wells Fargo is seeking a highly motivated and skilled Senior Cyber Security Application Penetration Testing Engineer to join its Technology Cybersecurity department. The role leads and conducts penetration testing on applications, identifies potential defects, and supports remediation discussions. It requires a strong understanding of web technologies and advanced knowledge of AI-enhanced scanners and tools. The engineer will also mentor colleagues in web application penetration-testing tools and techniques. The position involves researching, analyzing, designing, testing, and implementing security and protection technologies for company information, network systems, and applications. The engineer performs ethical penetration testing, develops proof-of-concept exploits to emulate attacker techniques, identifies vulnerabilities, and assesses their severity based on impact and ease of exploitation. Additional work includes testing networking devices, appliances, and web applications; developing custom testing techniques and tools; conducting security risk assessments; and reviewing security incidents and investigations. The engineer collaborates with colleagues and managers, provides guidance and mentorship to engineers interested in penetration testing and offensive security, and uses AI-assisted security tools to accelerate defect identification and validation. AI outputs must be evaluated with sound technical judgment, accounting for model limitations, security risks, and operational considerations, and usage must align with security, compliance, privacy, and ethical standards. The position follows a hybrid schedule of three days per week onsite and two days remote. It is not eligible for visa sponsorship. The listed base pay range is $100,000 to $196,000; employees may also be eligible for incentive opportunities. Pay may vary based on factors including performance, skills, experience, and work location.

Requirements

At least 4 years of Cyber Security Research experience, or equivalent demonstrated through work experience, training, military experience, education, or a combination of these.
At least 4 years of web application penetration-testing experience.
At least 4 years of Dynamic Application Security Testing (DAST) experience.
Strong understanding of web technologies.
Advanced knowledge and experience with AI-enhanced scanners and tools.
Ability to work a hybrid schedule: 3 days per week onsite/in office and 2 days per week remote.

Nice To Haves

Advanced experience with DAST tools such as Invicti, Appscan, Webinspect, Fiddler, and Burp Suite.
Advanced knowledge of application security and common vulnerabilities, including the OWASP Top 10.
Experience with scripting and automation, such as Python or Shell.
Knowledge of security best practices and compliance standards, such as PCI DSS and GDPR.
Excellent communication skills and ability to collaborate effectively with cross-functional teams.
Strong problem-solving and analytical skills.
Security certifications such as OSCP, BSCP, GWAPT, GPEN, GXPN, or equivalent.

Responsibilities

Lead or participate in research, analysis, design, testing, and implementation of computer network security and protection technologies for company information, network systems, and applications.
Conduct ethical penetration testing using hacking tools and develop or modify proof-of-concept exploits that mimic attacker techniques.
Identify vulnerabilities and assign severity ratings based on impact and ease of exploitation.
Review and analyze advanced security incident response activities and technical investigations related to information security incidents or breaches.
Test networking devices, appliance products, and web-based applications.
Develop custom penetration-testing techniques and tools.
Conduct security risk assessments to support compliance with corporate information security policies and best practices.
Provide guidance and leadership to Information Security Engineers and mentor engineers interested in penetration testing and offensive security.
Collaborate and consult with peers, colleagues, and managers to resolve issues and achieve goals.
Use AI-enhanced security scanners and tools to accelerate defect identification and validation.
Apply technical judgment when validating and integrating AI-assisted outputs, accounting for model limitations, security risks, and operational considerations.
Ensure AI usage aligns with security, compliance, privacy, and ethical standards.