Lead Engineer, Penetration Tester (Remote Eligible)

Lead Engineer, Penetration Tester

Target is an iconic brand, a Fortune 50 company and one of America's leading retailers. Target as a tech company? Absolutely. We're the behind-the-scenes powerhouse that fuels Target's passion and commitment to cutting-edge innovation. We anchor every facet of one of the world's best-loved retailers with a strong technology framework that relies on the latest tools and technologies—and the brightest people—to deliver incredible value to guests online and in stores. Target Technology Services is on a mission to offer the systems, tools and support that guests and team members need and deserve. Our high-performing teams balance independence with collaboration, and we pride ourselves on being versatile, agile and creative. We drive industry-leading technologies in support of every angle of the business, and help ensure that Target operates smoothly, securely and reliably from the inside out.

As a Lead Engineer, Penetration Tester on Target's Security Testing Services team, you will play a critical role in protecting our guests and brand. You'll leverage your deep understanding of Target's environment, strong partnerships, and relentless curiosity to deliver industry-leading penetration testing at scale. Our team values collaboration, respect, adaptability, and purpose. We conduct comprehensive assessments of key Target business functions and processes, including PCI-required testing. You'll collaborate directly with business teams across Target, gaining first-hand insight into how our systems and operations work together.

Use your skills, experience, and talents to help us achieve visionary goals. As a Lead Engineer, you will:

• Lead and perform penetration tests across Target-developed and third-party applications, including web, API, mobile, hardware, and scoped PCI assets
• Manage the full lifecycle of penetration testing from intake and scoping through discovery, testing, and validation of findings
• Identify, validate, and communicate security vulnerabilities across enterprise systems
• Deliver clear, actionable reports that articulate business impact and remediation guidance
• Partner with Target Tech and Security teams to explain findings, resolve issues, and improve overall security posture
• Mentor and coach team members to strengthen collective technical expertise
• Review and triage submissions from the Bug Bounty program; escalate critical findings to appropriate teams and help drive remediation
• Contribute to threat modeling activities, providing expert insights to identify and prioritize threats
• Provide technical oversight and assist in resolving complex security challenges
• Advocate for continuous improvement of penetration testing tools, processes, and automation
• Participate in on-call rotation for operational and bug bounty support

About You

• Bachelor's degree in Computer Science, Cybersecurity, or related field—or equivalent experience
• 7+ years of experience in cybersecurity, including at least 5 years focused on penetration testing or red team operations
• Strong expertise in penetration testing methodologies and web application security
• Advanced knowledge of application development, networking, and systems architecture
• Proficient with Burp Suite and other key security tools (e.g., Nmap, Nuclei, Metasploit, etc.)
• Skilled in scripting and automation using languages such as Python or Go
• Comfortable working across Mac, Windows, and Linux environments
• Strong communicator with the ability to translate complex security issues for technical and non-technical audiences
• Excellent time management and prioritization skills with the ability to meet deadlines
• Proven ability to foster collaboration, drive alignment within cross-functional teams, and demonstrate a solid understanding of how your work impacts the team and guests
• Passionate about mentorship, learning, and continuous improvement
• Demonstrated ability to stay current with evolving security threats and testing techniques
• Preferred Certifications: OSCP, OSCE, OSWE, or CISSP

Core responsibilities of this job are described within this job description. Job duties may change at any time due to business needs.

This position may be considered for a Remote or Hybrid (known internally at Target as "Flex for Your Day") work arrangement based on Target's needs. A Remote work arrangement means the team member works full-time from home or an alternate location that's not a Target location, does not have a desk at a Target location and may travel to HQ up to 4 times a year. A Hybrid/Flex for Your Day work arrangement means the team member's core role may be performed either remote or onsite at a Target location depending upon what your role, team and tasks require for that day. Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target.