Security Engineer, Penetration Testing

Your Future. Secured. ISC2 is a force for good. As the world’s leading nonprofit member organization for cybersecurity professionals, our core values — Integrity, Advocacy, Commitment, Inclusion, and Excellence — drive everything we do in support of our vision of a safe and secure cyber world.

The Security Engineer, Penetration Testing is a dual-function role responsible for both executing offensive security assessments and building the defensive engineering controls that harden ISC2’s environment. The role leads authorized penetration testing across ISC2’s applications, networks, and cloud infrastructure while also owning security engineering work — including security architecture review, tooling, automation, and control implementation — that translates findings into lasting improvements.

Responsibilities

• Plan, execute, and document internal and external penetration tests against ISC2 applications, networks, cloud environments, and infrastructure.
• Perform vulnerability assessments and validate findings to distinguish genuine risks from false positives.
• Conduct web application, API, mobile, and network vulnerability assessments using industry-standard methodologies (OWASP, PTES, OSSTMM).
• Produce clear, actionable written reports detailing findings, risk ratings, evidence, and remediation recommendations tailored to both technical and executive audiences.
• Develop and maintain the penetration testing program, including scope definitions, rules of engagement, and testing schedules.
• Own remediation follow-through: translate pen test findings into security engineering work items, validate fixes, and track resolution to closure in Jira Service Management.
• Design and implement security controls across ISC2’s cloud and on-premises environments.
• Participate in security architecture and design reviews for new systems, integrations, and third-party products.
• Support the Secure Software Development Lifecycle (SSDLC), including security requirements definition, code review support, and pre-deployment security validation.
• Maintain awareness of emerging vulnerabilities, exploits, and threat actor TTPs; operationalize threat intelligence into actionable hardening and detection improvements.

Qualifications

• Proficiency with penetration testing tools including Burp Suite, Metasploit, Nmap, Nessus, Cobalt Strike, and similar offensive frameworks.
• Strong understanding of web application vulnerabilities (OWASP Top 10), network protocols, Active Directory attack paths, and cloud security (Azure, AWS, GCP).
• Effective written and verbal communication with cross-functional teams is essential.
• Scripting and automation proficiency in Python, Bash, or PowerShell.
• Familiarity with MITRE ATT&CK, CVSS, CVE, NIST SP 800-115, and the CIS Benchmarks for secure configuration baselines.
• Relevant certifications strongly preferred: OSCP, GPEN or GWAPT, plus one engineering/architecture credential (CISSP, CSSLP, or equivalent).

Education and Work Experience

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
• 4+ years of experience in cybersecurity, with a demonstrable mix of offensive security (penetration testing) and defensive/engineering work.
• Experience with IAM security, including Okta and SAML/OAuth-based environments.
• Security engineering experience implementing and hardening controls across cloud and identity platforms.

Physical and Mental Demands

• Ability to travel up to 5% of the time.
• Work normal business hours and extended hours when necessary.
• Remain in a stationary position, often standing or sitting, for prolonged periods.

Total Rewards

The pay range for this position is £50,550 - £64,729/Yr. Final pay is based on several factors including but not limited to internal equity, market data, and the applicant’s education, work experience, certifications, etc.

Equal Employment Opportunity Statement

All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic as protected by applicable law.