Senior Penetration Tester (Mobile, API, Cloud)

At U.S. Bank, we’re on a journey to do our best—helping the customers and businesses we serve make better, smarter financial decisions and enabling the communities we support to grow and succeed. A career with U.S. Bank offers a wide, ever‑growing range of opportunities to discover what makes you thrive at every stage of your career.

Key Responsibilities

• Lead penetration testing engagements across mobile applications, APIs, web applications, cloud platforms, and supporting infrastructure.
• Perform manual security testing and exploitation to identify vulnerabilities, validate risk, and demonstrate business impact.
• Assess applications against industry standards including OWASP Top 10, OWASP API Security Top 10, OWASP MASVS, and MASTG.
• Evaluate security controls within AWS, Azure, containerized environments, and Kubernetes platforms.
• Conduct threat modeling and risk assessments to prioritize testing activities and remediation efforts.
• Develop detailed security reports including vulnerability analysis, risk ratings, attack paths, and remediation recommendations.
• Create and enhance security testing tools, scripts, and automation to improve operational effectiveness and assessment coverage.
• Mentor junior testers, support knowledge‑sharing initiatives, and collaborate with stakeholders to strengthen enterprise security practices.

Basic Qualifications

• Bachelor’s degree in Engineering or Science, or equivalent work experience.
• Eight or more years of experience in information security.
• Two or more years of experience in IT infrastructure management.
• Two or more years of experience in application architecture.
• Two or more years of experience in risk management.
• Two or more years of experience in data architecture.
• Two or more years of experience in middleware technology.
• Two or more years of experience in IT operations and project management.

Required Skills & Experience

• 8+ years of information security experience with demonstrated expertise in offensive security and penetration testing.
• 5+ years of hands‑on mobile application security testing for Android and iOS platforms.
• Strong knowledge of OWASP Top 10, API Security Top 10, SANS Top 25, OWASP MASVS, and MASTG frameworks.
• Advanced experience conducting manual penetration testing, exploit chaining, business logic testing, and access control assessments.
• Expert proficiency with Burp Suite Pro, Postman, Insomnia, Nmap, Metasploit, Kali Linux, and related security testing tools.
• Experience assessing security within AWS, Azure, Kubernetes, containers, and cloud‑native security platforms.
• Strong scripting and automation skills using Python, PowerShell, Bash, Ruby, or Go.
• Deep understanding of HTTP/S, REST APIs, OAuth, SAML, JWT, TCP/IP, DNS, firewalls, IDS/IPS, and application architecture.
• Knowledge of AI and machine‑learning security risks, including prompt injection, insecure model access, API abuse, and data leakage concerns.
• Familiarity with PCI‑DSS, HIPAA, NIST 800‑53, ISO 27001, FedRAMP, and other security compliance frameworks.
• Excellent communication skills with the ability to present findings to technical teams, business stakeholders, and executive leadership.

Location Expectations

This role requires working from a U.S. Bank location three (3) or more days per week.

Benefits

• Healthcare (medical, dental, vision)
• Basic term and optional term life insurance
• Short‑term and long‑term disability
• Pregnancy disability and parental leave
• 401(k) and employer‑funded retirement plan
• Paid vacation (from two to five weeks depending on salary grade and tenure)
• Up to 11 paid holiday opportunities
• Adoption assistance
• Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law