Penetration Testing Analyst, Vice President

About the role

We are seeking a Vice President, Penetration Testing Analyst, to join State Street's Threat Intelligence and Assurance organization. This is a senior, hands-on technical role and serves as the team's in-house technical authority for complex penetration testing engagements and for validating remediation.

Why this role is important to us

You will lead the technical execution of scenario-based testing against high-value systems and services, and you will own the validation of fixes for the resulting findings. Working with finding owners, offensive security partners, external testing providers, security operations, and risk and regulatory partners, you will make sure testing is realistic, findings are technically sound, and every fix holds up under real-world attack conditions. You will be accountable for the technical defensibility of closure decisions presented to senior leadership and the Lines of Defense. You will also help mature a repeatable, high-quality internal testing capability.

Responsibilities

• Serve as the senior technical lead across the engagement lifecycle, including scoping, test planning, rules of engagement, execution oversight, and post-test remediation planning.
• Provide real-time technical guidance during engagements by assessing tester activity, judging operational risk, and guiding escalation decisions with appropriate discretion.
• Hold external testing providers to a high technical standard by challenging their attack paths, evidence quality, severity ratings, and MITRE ATT&CK mapping, so that results are accurate, actionable, and defensible.
• Lead coordination with finding owners and engineering teams to turn findings into clear technical remediation requirements and measurable validation criteria, so fixes address root causes rather than narrow point issues.
• Lead the strategy for validating remediation. This includes grouping related findings, defining test criteria and expected outcomes, and personally retesting fixes against the original attack path and other ways of reaching the same objective.
• Assess remediation across the wider estate, including variant attack paths, implementation consistency, and any new exposure the fix itself introduces.
• Make the final technical call on closure recommendations, backed by evidence-based reporting that confirms each finding as closed, open, or partially closed, with executive summaries for senior and non-technical audiences.
• Present testing