Penetration Testing Manager

Who We Are Looking ForWe are seeking a Manager to lead State Street’s Penetration Testing Team, reporting into leadership within the Threat Intelligence and Assurance function. This role combines technical leadership with program ownership, focused on delivering high-quality, engineering-driven penetration testing across a complex, highly regulated financial environment. You will be responsible for building and maturing a team that performs rigorous, hands-on assessments across applications, networks, APIs, and cloud platforms, while establishing consistent, risk-aligned testing practices. The Manager is accountable for defining technical standards, ensuring depth and quality of testing, and delivering outputs that are evidence-based, reproducible, and aligned with audit and regulatory expectations. Working closely with engineering, architecture, and risk partners, you will ensure testing results translate into measurable risk reduction and sustained improvements in secure system design and implementation.What you will be responsible forAs a Manager, Penetration Testing, you will:Lead, mentor, and develop a team of penetration testers, fostering strong technical depth, hands-on expertise, and continuous skill development across application, network, and cloud domainsOwn and evolve the penetration testing program, including methodologies, tooling, quality assurance practices, reporting standards, and risk-based prioritization of testing activitiesDrive delivery of high quality, hands on testing across enterprise applications, APIs, infrastructure, and cloud environments, ensuring assessments are technically rigorous and aligned to real-world exploitabilityEstablish and enforce engineering-centric testing standards, ensuring consistency, reproducibility, and depth across both internal and third-party executed assessmentsOversee and coordinate testing performed by external providers, including scoping, execution expectations, and technical validation of results to ensure quality and accuracyEnsure regulator and audit ready outputs, including clear documentation, evidence-based findings, and reporting that ties technical vulnerabilities to business and risk impactPartner with engineering, infrastructure, and architecture teams to drive effective remediation, validate fixes, and improve secure design and development practicesIntegrate emerging technologies and techniques into the program, including AI/LLM-focused testing approaches and assurance of enterprise AI deployments (e.g., prompt injection, model abuse, data exposure)Track, analyze, and communicate program metrics, including coverage, risk trends, vulnerability recurrence, and remediation performance, providing clear insights to senior leadershipContinuously improve program maturity, balancing technical depth with scalability, consistency, and alignment to evolving threats, technologies, and regulatory expectationsWhat we valueThese skills will help you succeed in this roleLeadership through influence and accountability, with a focus on developing talent and building high-trust teams.Risk-based decision making, prioritizing what matters most in complex, regulated environments.Technical depth with strategic perspective—ability to connect hands-on findings to enterprise risk outcomes.Clear, executive-ready communication tailored to technical and non-technical audiences.Curiosity and continuous learning, especially in emerging areas such as AI/LLM security.Collaboration and partnership across engineering, risk, and business stakeholders.Ownership and bias for action, ensuring issues are driven through remediation and closure.Education & Preferred Qualifications8+ years in offensive security with experience in high security/highly regulated environments; 2+ years leading teams preferred.Deep expertise in network and application penetration testing, including enterprise attack paths and complex application ecosystems.Strong knowledge of cloud, containerized environments, and identity-centric architectures.Demonstrated ability to translate findings into actionable, risk-based remediation.Strong stakeholder engagement and executive communication skills.Prior successful experience working with technology owners and business unit leaders to reduce riskNice to have: experience using AI/LLM tools to perform network and application penetration testing and configuration/security reviews.Education/Certifications (desired, not mandatory): BS/MS in relevant field; OSCP/OSEP/OSCE, GPEN/GXPN, GWAPT, GCPN, PNPT, CREST (CRT, CCT INF, CCT APP, CCRTS, CCRTM) or similar.Salary Range:$140,000 - $222,500 AnnualThe range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.For a full overview, visit State StreetAcross the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.Discover more information on jobs at StateStreet.com/careersRead our CEO StatementJob Application Disclosure:It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability. #J-18808-Ljbffr STATE STREET CORPORATION