Mainframe and Web Application Security Senior Engineer - Senior Penetration Tester

Onsite in Charlotte, NC with a compensation range of $140,000 to $180,000 annually
. This role focuses on improving how security testing covers enterprise z/OS and mainframe environments, while partnering with teams to validate remediation and strengthen repeatable offensive testing practices.

• Medical insurance
• Dental insurance
• Vision insurance
• Life insurance
• Disability insurance
• Accidental death and dismemberment
• Tax-preferred savings accounts
• 401k plan
• No less than 10 days of vacation during the first year of employment (prorated based on hire date and full-time/part-time status)
• 10 sick days (also prorated)
• Paid holidays
• Defined benefit pension plan (depending on position and division)
• Restricted stock units (depending on position and division)
• Deferred compensation plan (depending on position and division)

Benefits eligibility: All regular teammates working 20 hours or more per week are eligible for benefits, with specific benefits determined by the division.

• Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS
  , including coverage across USS (Unix System Services) and security subsystems such as RACF, ACF2, and Top Secret
  .
• Test core mainframe workloads and interfaces including CICS, IMS, db2, MQ
  , plus batch processing components such as JCL and JES2
  , and TSO/ISPF
  .
• Assess network-facing services including TN3270, FTP, Z/OS Connect, Rest APIs
  , and NJE
  .
• Apply manual techniques and custom scripting using REXX, JCL, Assembler, and Python
  , along with offensive tooling to enumerate users and resources, map datasets, assess access to unprotected spool and job output, and exploit misconfigured CICS transactions and insecure interfaces.
• Evaluate exploitability and business impact
  , applying judgment to determine finding severity and risk
  .
• Document findings with clear reproduction steps, supporting evidence, impact statements, and practical remediation recommendations.
• Present and defend technical findings to application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders.
• Perform validation and retesting to confirm remediation and risk reduction, and maintain testing evidence to support audit, regulatory, and compliance requirements including PCI DSS and SOX
  .
• Partner with internal and external testing teams to improve mainframe testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes.
• Conduct peer reviews of penetration testing reports and provide technical guidance and mentorship to other security professionals.
• Maintain current knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats.

• Bachelor’s degree or equivalent education, training, and work-related experience.
• Minimum of 7 years of experience in security engineering or related cybersecurity roles.
• Deep specialized knowledge of cybersecurity principles, theories, and concepts.
• Proven experience with software development lifecycle security practices.
• Deep knowledge of threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.

• Five or more years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience.
• Hands-on experience assessing mainframe environments, including z/OS and security components such as RACF, ACF2, or Top Secret
  .
• Knowledge of mainframe architecture, identity and access management, privileged access,
  JCL, TSO/ISPF, CICS, Db2
  , network services, system configuration, and security hardening.
• Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive…