Penetration Testing Manager

Who We Are Looking For We are seeking a Manager to lead State Street’s Penetration Testing Team, reporting into leadership within the Threat Intelligence and Assurance function. This role combines technical leadership with program ownership, focused on delivering high-quality, engineering‑driven penetration testing across a complex, highly regulated financial environment. You will be responsible for building and maturing a team that performs rigorous, hands‑on assessments across applications, networks, APIs, and cloud platforms, while establishing consistent, risk‑aligned testing practices. The Manager is accountable for defining technical standards, ensuring depth and quality of testing, and delivering outputs that are evidence‑based, reproducible, and aligned with audit and regulatory expectations. Working closely with engineering, architecture, and risk partners, you will ensure testing results translate into measurable risk reduction and sustained improvements in secure system design and implementation. What You Will Be Responsible For As a Manager, Penetration Testing, you will: Lead, mentor, and develop a team of penetration testers, fostering strong technical depth, hands‑on expertise, and continuous skill development across application, network, and cloud domains. Own and evolve the penetration testing program, including methodologies, tooling, quality assurance practices, reporting standards, and risk‑based prioritization of testing activities. Drive delivery of high quality, hands‑on testing across enterprise applications, APIs, infrastructure, and cloud environments, ensuring assessments are technically rigorous and aligned to real‑world exploitability. Establish and enforce engineering‑centric testing standards, ensuring consistency, reproducibility, and depth across both internal and third‑party executed assessments. Oversee and coordinate testing performed by external providers, including scoping, execution expectations, and technical validation of results to ensure quality and accuracy. Ensure regulator and audit ready outputs, including clear documentation, evidence‑based findings, and reporting that ties technical vulnerabilities to business and risk impact. Partner with engineering, infrastructure, and architecture teams to drive effective remediation, validate fixes, and improve secure design and development practices. Integrate emerging technologies and techniques into the program, including AI/LLM‑focused testing approaches and assurance of enterprise AI deployments (e.g., prompt injection, model abuse, data exposure). Track, analyze, and communicate program metrics, including coverage, risk trends, vulnerability recurrence, and remediation performance, providing clear insights to senior leadership. Continuously improve program maturity, balancing technical depth with scalability, consistency, and alignment to evolving threats, technologies, and regulatory expectations. What We Value These skills will help you succeed in this role Leadership through influence and accountability, with a focus on developing talent and building high‑trust teams. Risk‑based decision making, prioritizing what matters most in complex, regulated environments. Technical depth with strategic perspective—ability to connect hands‑on findings to enterprise risk outcomes. Clear, executive‑ready communication tailored to technical and non‑technical audiences. Curiosity and continuous learning, especially in emerging areas such as AI/LLM security. Collaboration and partnership across engineering, risk, and business stakeholders. Ownership and bias for action, ensuring issues are driven through remediation and closure. Education & Preferred Qualifications 8+ years in offensive security with experience in high security/highly regulated environments; 2+ years leading teams preferred. Deep expertise in network and application penetration testing, including enterprise attack paths and complex application ecosystems. Strong knowledge of cloud, containerized environments, and identity‑centric architectures. Demonstrated ability to translate findings into actionable, risk‑based remediation. Strong stakeholder engagement and executive communication skills. Prior successful experience working with technology owners and business unit leaders to reduce risk. Nice to have: experience using AI/LLM tools to perform network and application penetration testing and configuration/security reviews. Education/Certifications (desired, not mandatory): BS/MS in relevant field; OSCP/OSEP/OSCE, GPEN/GXPN, GWAPT, GCPN, PNPT, CREST (CRT, CCT INF, CCT APP, CCRTS, CCRTM) or similar. Salary Range $140,000 - $222,500 Annual The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ. Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long‑term disability, and other optional additional coverages; paid‑time off including vacation, sick leave, short‑term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance‑based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax‑advantaged savings plans. Job Application Disclosure It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability. Equal Opportunity Employer As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law. #J-18808-Ljbffr State Street Corporation