Principal Penetration Tester

Principal Penetration Tester

The Principal Penetration Tester is responsible for strengthening internal security assurance across enterprise technology environments through independent, compliance focused security testing. This role evaluates the design and operating effectiveness of security controls, identifies gaps against regulatory, policy, and risk requirements, and supports audit and regulatory readiness. The position also plays a key role in building and maturing a centralized internal security testing capability with defensible, repeatable outcomes.

This role is centered on internal security and compliance testing, with emphasis on assessing control effectiveness, validating controls through realistic threat scenarios, and producing clear, audit ready results that inform leadership decisions and remediation priorities.

• Plan, execute, and analyze regulatory and internal security testing across applications, cloud platforms, infrastructure, and endpoint environments

• Evaluate security control effectiveness using threat informed methodologies that consider adversary behavior, attack techniques, and architectural context

• Perform scenario based testing to validate controls under realistic operating conditions

• Analyze findings and deliver clear, actionable reporting aligned to business and risk impact

• Partner with technology owners to support remediation planning and validation testing

• Coordinate with internal and external testing teams to manage execution risks and dependencies

• Support internal audit and regulatory examinations by providing testing results, evidence, and assessments

• Partner with leadership to build, formalize, and mature a centralized internal security testing program and governance model

• Mentor and provide technical guidance to other security testing resources

• Contribute to metrics, dashboards, and reporting that demonstrate control maturity and risk reduction

• Identify opportunities to improve efficiency through automation of testing and evidence collection

• 10+ years of cybersecurity experience with strong focus on security control testing, assurance, or risk based security assessments

• Proven experience evaluating security controls across cloud, application, network, and infrastructure environments

• Strong working knowledge of security frameworks and standards such as NIST, ISO, CIS, OWASP, CVSS, and internal risk models

• Experience supporting internal audit activities, regulatory examinations, or compliance programs

• Demonstrated ability to design defensible test plans, evaluate evidence, and assess control design and operating effectiveness

• Strong written communication skills with experience producing audit ready documentation and executive level reporting

• Ability to collaborate and influence across engineering, risk, audit, and compliance stakeholders

• Experience in highly regulated enterprise environments such as financial services

• Familiarity with secure development practices and DevSecOps control validation

• Experience automating security testing or evidence collection using scripting or security tooling

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field

• Preferred certifications include GPEN, CISSP, CISA, OSCP, or equivalent

The salary range for this position is $150,000-$170,000 per year plus an opportunity to earn an annual discretionary bonus. Actual pay is based on various factors including but not limited to the work location, and relevant skills and experience.

We offer competitive pay, comprehensive medical, dental and vision coverage, retirement benefits, maternity/paternity leave, flexible work arrangements, education reimbursement, wellness programs and more. Note, Citizens' paid time off policy exceeds the mandatory, paid sick or paid time-away policy of very local and state jurisdiction in the United States. For an overview of our benefits, visit

Required Skills

• Agility
• Building Relationships
• Capacity Optimization
• Collaborating
• Compliance and Controls
• Contingency Planning
• Customer-Centricity
• Cyber Security Strategy
• Emerging Technologies
• IT Service Continuity Management
• Incident and Problem Management
• Industry Insight
• Innovation
• Leading Others
• Motivating Others
• Performance Measurement
• Principles of Information Technology
• Strategic Thinking
• Systems Implementation and Management
• Technologically Savvy
• Valuing Diversity and Inclusion

About Us

Equal Employment Opportunity

Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague's or a dependent's reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws. At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.

Equal Employment and Opportunity Employer

Job Applicant Data Privacy Policy

Background Check

Any offer of employment is conditioned upon the candidate successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results of the background check are individually reviewed based upon legal requirements imposed by our regulators and with consideration of the nature and gravity of the background history and the job offered. Any offer of employment will include further information.

Job Info

• Job Identification 46274
• Job Category Technology
• Posting Date 04/17/2026, 09:06 PM
• Degree Level Bachelor's Degree
• Job Schedule Full time
• Job Shift 1st
• Locations One Citizens Bank Way, Johnston, RI, 02919, US
• Working Hours 40
• Career Site Category Cyber Security