Lead Penetration Test Engineer

We need to output only HTML fragment, using

for section headings (About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We must not repeat job title as heading. We must not include Job ID etc. Remove boilerplate, navigation, legal, EEO, scam-warning, duplicated lines, application instructions. Preserve all substantive information. We need to decide which sections to include based on content. The posting includes: - About The Role: includes Grade Level (internal), The Role title, Location, The Team description. - Responsibilities and Impact: includes bullet list of responsibilities. - What We’re Looking For: includes Basic Required Qualifications (list), Preferred Qualifications (list). - Right To Work Requirements (US and Canada) – maybe not needed as heading? Could be part of Requirements? But we have sections: Requirements, Qualifications, Skills, Benefits, Pay, Schedule. The instructions: Use headings for those specific labels if content exists. We need to decide which sections have real content. We have Pay info: Compensation/Benefits Information (US Applicants Only) gives salary range $135k-$200k. Also for Canada: range 135k-180k CAD. So we have Pay section. Benefits: There's a "What’s In It For You?" section with mission, people, values, then "Benefits" subsection with list of benefits. So we have Benefits. Schedule: Not mentioned; no schedule info. So we should not create Schedule heading. Skills: Could be derived from qualifications? But we have separate Qualifications and Skills sections. The posting includes qualifications (required, preferred) and also skills (tools, scripting). Could map required qualifications to Requirements? The instructions: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to map content accordingly. We have: - About the role: includes description of role, team, location. - Responsibilities: list of responsibilities. - Requirements: maybe basic required qualifications? Or "Right To Work Requirements"? But likely "Requirements" heading for basic required qualifications. - Qualifications: maybe preferred qualifications? Or could combine both required and preferred under Qualifications? But we have both Requirements and Qualifications headings available. We could put basic required qualifications under Requirements, and preferred qualifications under Qualifications. - Skills: could include technical skills like tools, scripting, cloud, etc. But those are already in qualifications. However we could extract skills from the qualifications: e.g., experience with penetration testing tools, scripting, cloud security, AI/ML security, etc. Could put under Skills. - Benefits: list of benefits. - Pay: salary ranges. We must not include boilerplate like Equal Opportunity Employer, Recruitment Fraud Alert, etc. Also remove "Right To Work Requirements" maybe not needed as heading; but we could incorporate that info into Requirements? However the instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." Right To Work Requirements is not minor metadata; it's eligibility requirement. Could be part of Requirements section. But we already have a Requirements heading for basic required qualifications. Could add a paragraph about right to work. But we must preserve all substantive information. So we need to include right to work info somewhere. We also have location: US - Virtual, or Canada - Virtual. Could be part of About the role. We must not include duplicated lines. We need to output only HTML fragment, no /, no markdown fences. Let's structure:

About the role

Lead Penetration Test Engineer – S&P Global Corporate. Location: US - Virtual, or Canada - Virtual. The S&P Ratings Security team focuses on protecting clients and users from modern security threats, safeguarding systems and data by developing innovative solutions to complex security challenges. The team consists of passionate problem solvers with deep security expertise.

Responsibilities

• Conduct comprehensive penetration testing of web applications, infrastructure, and cloud environments using manual and automated techniques.
• Develop custom scripts, tools, and methodologies to enhance penetration testing capabilities and automate security testing within CI/CD pipelines.
• Apply cloud‑specific offensive techniques, including IAM abuse, container and serverless exploitation, and cloud misconfiguration testing.
• Collaborate with engineering and development teams to analyze vulnerabilities, develop remediation plans, and strengthen application security across development and production lifecycles.
• Perform detailed security assessments using DAST, SAST, and SCA tools to ensure continuous validation and improvement of security controls.
• Lead and participate in attack simulations and tabletop exercises to validate security controls and improve organizational response capabilities.
• Research emerging threats, attack vectors, and adversarial techniques to inform offensive and defensive strategies.
• Partner with internal teams to design and execute threat assessments based on intelligence feeds and threat actor analysis.
• Communicate and present penetration testing and security assessment findings to both technical and non‑technical stakeholders.
• Provide actionable remediation guidance and risk mitigation strategies to strengthen the organization’s overall security posture.

Requirements

• Minimum 8 years of experience in information security with a strong focus on penetration testing, application security, and vulnerability management.
• Hands‑on experience with penetration testing tools (e.g., Burp Suite, Nessus, Metasploit, Nmap) and methodologies (e.g., OWASP Top 10, MITRE ATT&CK, PTES).
• Expertise in identifying and exploiting common infrastructure and web application vulnerabilities (e.g., XSS, SQL Injection, IDOR).
• Familiarity with vulnerability classification and scoring frameworks (CVE, CVSS, CWE).
• Strong scripting or programming skills (e.g., Bash, Python, Go, PowerShell, JavaScript).
• Experience performing security assessments (DAST, SAST, SCA, credential scanning) and integrating security testing into CI/CD pipelines.
• Ability to translate complex technical findings into clear, actionable reports and confidently brief cross‑functional teams and executives.
• At least one recognized offensive security certification (OSCP, OSCE3, OSEP, GXPN, GPEN, or CREST CRT/CCT).
• Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent experience.
• Right to work: candidates must have indefinite right to work within the US (for US‑based applicants) or within Canada (for Canada‑based applicants).

Qualifications

• Experience with cloud security across AWS, Azure, or GCP.
• Knowledge of AI/ML security and adversarial testing methods, including evaluating LLMs and other models for manipulation, evasion, and data integrity risks.
• Demonstrated involvement in the infosec community (e.g., open‑source projects, bug bounties, CVE research, conference talks, or security publications).
• Experience applying the MITRE ATT&CK Framework to offensive security operations and threat emulation.
• Familiarity with secure software development practices and the software development lifecycle.
• Experience with Java application technologies, deployment frameworks, and associated security best practices.
• Ability to work collaboratively across teams while independently owning deliverables and maintaining accountability to deadlines.

Skills

While many skills are captured in the requirements and qualifications, notable technical proficiencies include: penetration testing (Burp Suite, Nessus, Metasploit, Nmap), scripting (Bash, Python, Go, PowerShell, JavaScript), cloud offensive techniques (IAM abuse, container/serverless exploitation), vulnerability assessment tools (DAST, SAST, SCA), CI/CD pipeline integration, reporting and stakeholder communication, and knowledge of frameworks (OWASP Top 10, MITRE ATT&CK, CVE/CVSS/CWE).

Benefits

• Health & Wellness: Health care coverage designed for the mind and body.
• Flexible Downtime: Generous time off helps keep you energized for your time on.
• Continuous Learning: Access a wealth of resources to grow your career and learn valuable new skills.
• Invest in Your Future: Secure your financial future through competitive pay, retirement planning, a continuing education program with a company‑matched student loan contribution, and financial wellness programs.
• Family Friendly Perks: Benefits for partners and little ones, including best‑in‑class family benefits.
• Beyond the Basics: Retail discounts, referral incentive awards, and other small perks that can make a big difference.

Pay

For US‑based applicants: anticipated base salary range $135,000 USD – $200,000 USD. Final base salary will be based on geographical location, experience, and qualifications.

For Canada‑based applicants: anticipated compensation range 135,000 CAD – 180,000 CAD. Final compensation will be based on performance, geographic location, experience level, skill set, training, licenses, and certifications.

We must not include Schedule heading. Check for any duplicated content: We have not repeated job title. We have not included boilerplate like EEO, fraud alert, etc. We have preserved all substantive info: role description, team, responsibilities, requirements (including right to work), qualifications (preferred), skills (summary), benefits, pay. We might have missed some details: The "About The Role" also had "Grade Level (for internal use): 12 S&P Global Corporate". Should we include that? It's internal metadata; maybe minor, but could be included as a short paragraph. The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." Grade Level is minor metadata; we could fold into About the role paragraph. We didn't include it. Let's add it. Also "The Role: Lead Penetration Test Engineer" we already have as role title in heading? Actually we didn't repeat job title as heading, but we can include it in the paragraph. We also have "Location: US - Virtual, or Canada - Virtual". Already included. We also have "The Team" description included. We also have "What We’re Looking For" split into Basic Required Qualifications and Preferred Qualifications; we used Requirements and Qualifications. We also have "Right To Work Requirements For US Based Out Candidates" and "For Canada Based Out Candidates". We incorporated into Requirements. We also have "Compensation/Benefits Information (US Applicants Only)" and Canada version; we used Pay. We also have "What’s In It For You?" includes Mission, People, Values, Benefits. We captured Benefits; we could also include Mission/People/Values as part of About the role? Might be considered substantive but not under a specific heading. The instruction: Prefer a few substantive sections over many thin ones. Could include a short paragraph about mission/values under About the role. But we already have About the role paragraph; we could add a sentence about mission/values. However we must not invent or summarize away detail. We can include the mission statement: "Our Mission Advancing Essential Intelligence." Also "Our People ..." and "Our Values Integrity, Discovery, Partnership". That is substantive. We could add a paragraph after About the role or maybe a separate section? There's no heading for Mission/Values/People. Could incorporate into About the role as extra sentences. But we must not create a heading unless there's real specific content for it. So we