Senior AI Penetration Tester (New York)

Job Summary

Fitch Group is seeking a Senior AI Penetration Tester based out of our New York office. This role is within the Information Security department and involves conducting security assessments of AI systems and implementing controls.

Key Responsibilities

• Conduct security assessments of AI systems and implementations — including AI chatbots, MCP (Model Context Protocol) servers, and enterprise deployments of Claude, ChatGPT, and Azure OpenAI Studio — identifying risks such as prompt injection, model abuse, data exfiltration etc.
• Execute continuous adversarial testing of AI platforms and guardrails to validate controls keep pace with evolving vendor capabilities.
• Plan, scope, and execute penetration testing engagements across network infrastructure (servers, firewalls, endpoints, Active Directory) and perform comprehensive web application security assessments covering OWASP Top 10 vulnerabilities, business logic flaws, authentication weaknesses, and API security issues — following OWASP, and MITRE ATT&CK and other methodologies.
• Leverage AI agents and AI-assisted tooling (such as Claude and ChatGPT) to augment testing workflows and automate reconnaissance, while developing and maintaining custom scripts and exploit code for attack chain automation, payload generation, and post-exploitation tasks.
• Document and communicate assessment outcomes — including findings, risk context, and remediation guidance — clearly for both technical teams and senior stakeholders; collaborate with Vulnerability Management, Application, and Infrastructure teams to ensure findings are handed off with clear remediation ownership.
• Stay current with the latest offensive security research, CVEs, exploitation techniques, and AI security threats; support red team exercises and threat simulation activities; and maintain detailed records of testing activities, methodologies, and evidence per internal documentation standards.

Requirements

• 2–4 years of hands-on penetration testing experience, deep technical expertise, a proactive approach to identifying security gaps, and the ability to leverage AI agents and automation to continuously improve testing capabilities.
• Strong scripting and exploit development skills, comfort working with AI-powered tools, and the ability to communicate complex technical findings clearly and effectively.
• Experience assessing AI systems and LLM-based applications in enterprise deployments (Claude, ChatGPT, Azure OpenAI Studio, or similar), identifying risks including prompt injection, insecure tool use, MCP server misconfigurations, and risks across agentic orchestration workflows.
• Experience testing AI systems in regulated or data-sensitive environments where material non-public information (MNPI), confidential client data, or similar controlled data classes are in scope.
• Experience with cloud penetration testing across AWS, Azure, or GCP environments, and/or exposure to container and Kubernetes security assessments.
• Knowledge of secure coding practices and ability to perform basic code review to support application security engagements; familiarity with compliance frameworks such as PCI DSS, DORA, and ISO 27001.

Qualifications

• Certifications such as OSCP, CEH, GPEN, GWAPT; a degree in Computer Science, Cybersecurity, Information Systems, or equivalent practical experience; and/or participation in bug bounty programs or CTF competitions.

Benefits

Fitch offers a hybrid work environment, dedicated trainings, leadership development and mentorship programs, retirement planning, financial wellness and tuition reimbursement programs, comprehensive healthcare offerings, family-first policies, and paid volunteer days.

Pay

Expected base pay rates for the role will be between $140,000 and $160,000 per year. Actual salaries will be determined on an individualized basis and may vary based on factors including but not limited to education, training, experience, past performance, and other job-related factors.

Schedule

2 to 3 days a week in office required based on your line of business and location.