Senior Penetration Tester (REMOTE)

Employment Type: Full time Shift: Day Shift Description: The Senior level Penetration Tester will serve as the Red Team technical lead for Offensive Security. They will be responsible for Red Team Engagements, Application Penetration Tests, and Purple Team Engagement activities. The Senior Penetration Tester leads red team threat emulation and advanced penetration testing services for Trinity Health.

This position is responsible for defining testing strategies, executing complex assessments across diverse infrastructures, and serving as the primary technical authority for penetration testing. The Senior Penetration Tester designs threat scenarios, provides strategic recommendations, and leads efforts to enhance the organization's overall security posture.

This role requires deep technical expertise, strategic vision, and leadership in guiding the team toward proactive risk management. - Leads penetration testing of network and application infrastructures, using both automated and manual testing techniques. Identifies vulnerabilities, evaluates potential risks, and documents findings thoroughly.

Provides clear recommendations for remediation, ensuring reports meet professional standards and are suitable for technical teams and stakeholders. - Leads and executes end-to-end adversarial Red Team engagements, including scoping and rules-of-engagement development, threat-informed attack planning, deployment and management of secure command-and-control infrastructure, execution of multi-stage attack paths, operational security, evidence collection, risk-based reporting, and collaboration with defensive teams to validate detection and response capabilities. - Leads and executes regular Threat Intelligence-led Purple Team Engagements with Blue Team.

Reports to teams responsible for remediation. Validates remediation after completion. Reports results of Purple Team Engagements to upper leadership. - Leads retesting and validation efforts for critical vulnerabilities, ensuring the effectiveness of remediation measures and sustained security improvements.

Conducts advanced assessments, provides strategic guidance, and delivers detailed feedback to improve security posture across the organization. - May be consulted to assist in root cause analysis for security incidents, collaborating with cross-functional teams to identify systemic issues and potential security gaps. Provides strategic recommendations for corrective actions, supporting long-term improvements in security strategy and architecture. - May be consulted to provide expertise for security projects throughout a project's lifecycle. - Demonstrates mastery in penetration testing and red team operations, continuously seeking to expand knowledge of tools, techniques, and methodologies.

Stays ahead of evolving threats and industry developments, integrating new knowledge into team operations and training programs. - Serves as the primary technical mentor for junior and mid-level penetration testers (Penetration Tester I & II). Provides in-depth training, shares advanced knowledge, and promotes skill development.

Drives team growth by leading technical workshops and fostering a collaborative learning environment. - Produces high-level, strategic reports and documentation, including in-depth risk analyses, security recommendations, and executive summaries. Communicates complex findings effectively to both technical teams and senior management, ensuring clear understanding and actionable outcomes. - Oversees and manages ITSM workflow processes using tools like ServiceNow and Jira.

Ensures documentation is comprehensive, accurate, and up-to-date, optimizing task management and communication within the team and across the organization. - Demonstrates the ability to effectively manage time and resources by setting clear priorities, balancing multiple projects, and adjusting plans as needed. Shows resilience and flexibility in adapting to new technologies, shifting organizational needs, and emerging security threats, ensuring continued productivity and alignment with strategic objectives. - Keeps up-to-date with relevant laws, regulations, and compliance requirements that impact penetration testing and red teaming activities.

Understands and adheres to organizational codes of conduct, ensuring all activities are conducted ethically and in compliance with legal and professional standards. Engages in regular training to stay informed about evolving regulations and best practices in the cybersecurity industry. - Performs other duties as assigned.

Minimum Qualifications Bachelor's degree in Information Security, Computer Science, or a related field. Equivalent experience considered in lieu of degree. 6-8+ years of experience in penetration testing, red teaming, or a related field, with a demonstrated track record of leading complex assessments.

Deep knowledge of Active Directory and Microsoft Entra ID architecture, authentication, authorization, privilege escalation paths, security controls, and cross-environment attack paths. Fluency in designing, building, and maintaining secure cloud-based command-and-control infrastructure. Expert-level experience developing and safely operating custom offensive capabilities for authorized adversary emulation, including controlled payloads, post-exploitation tooling, and C2 integrations for use in Red Team Engagements with Operational Security considerations.

Advanced scripting and programming skills in languages like Python, C, or PowerShell, with experience in automating testing processes. Proficiency in using ITSM tools like ServiceNow and Jira for managing complex documentation, tracking advanced remediation efforts, and leading workflow optimization. Expertise in a wide range of penetration testing tools and custom exploitation techniques, capable of designing complex attack simulations and emulations.

Extensive knowledge of compliance requirements, ethical best practices, and regulations impacting penetration testing. Actively pursues advanced certifications and continuously engages in professional development to remain at the forefront of industry trends. Additional Qualifications (nice to have) Competency-based certifications like OSCP, CRTO, eWPTX, OSEP, OSWE, OSED, OSCE3.

Advanced Practical Penetration Testing and Red Team Certifications. I.E. OSEP, OSED, OSWE, OSCE3 are highly desirable.

Physical & Mental Requirements & Working Conditions (General Summary) Direct Healthcare Services / Indirect Healthcare / Support Services: Exposure to conditions which may be considered unpleasant to sight, touch, sound & / or smell. Occasional Exposure to fumes, odors, dusts, mists & gases, biohazards / hazards (mechanical, electrical, burns, chemicals, radiation, sharp objects, etc.).

Occasional Exposure to or subject to noise, infectious waste, diseases & conditions. Occasional Exposure to interruptions, shifting priorities & stressful situations. Frequent Ability to follow tasks through to completion, understand & relate to complex ideas / concepts, remember multiple tasks & regimens over long periods of time & work on concurrent tasks / projects.

Continuous Ability to read small print, hear sounds & voice / speech patterns, give / receive instructions & other verbal communications (in-person & / or over the phone / computer / device / equipment assigned) with some background noise. Continuous Perform manual dexterity activities & / or grasping / handling. Occasional Ability to climb, kneel, crouch & / or operate foot controls.

Occasional Use a computer / other technology. Continuous Sit with the ability to vary / adjust physical position or activity. Frequent Maintain a safe working environment & use available personal protective equipment (PPE).

Occasional Comply with applicable Code of Conduct, policies, procedures & guidelines. Continuous Ability to provide assistance in the event of an emergency. Occasional Direct Healthcare Services: Perform activities that require standing / walking with the ability to vary / adjust physical position or activity.

Occasional Lift a maximum of 30 pounds unassisted. Occasional Use upper & lower extremities, engage in bending / stooping / reaching & pushing / pulling. Occasional Work indoors (subject to travel requirements) under temperature-controlled & well-lit conditions.

Continuous Encounter worksites (e.g., patient homes) or travel to worksites that may have variable internal & external environmental conditions. Occasional Perform work that involves physical efforts (e.g., transporting, moving, positioning & / or ambulating patients). Occasional Indirect Healthcare / Support Services: Perform activities that require standing / walking with the ability to vary / adjust physical position or activity.

Occasional Lift a maximum of 30 pounds unassisted. Occasional Experience of long periods of walking / standing / stooping / bending / pulling & / or pushing. Occasional Encounter a clinical / patient facing / hands on interactive work environment.

Occasional Work indoors (subject to travel requirements) under temperature-controlled & well-lit conditions. Continuous Work outdoors with variable external environmental conditions. Occasional Average Workday Activity: Occasional - O (1% - 33%), Frequent - F (34% - 66%), Continuous - C (67% - 100%) Our Commitment Rooted in our Mission and Core Values, we honor the dignity of every person and recognize the unique perspectives, experiences, and talents each colleague brings.

By finding common ground and embracing our differences, we grow stronger together and deliver more compassionate, person-centered care. We are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other status protected by federal, state, or local law.

Trinity Health is one of the largest not-for-profit, faith-based health care systems in the nation. Together, we're 121,000 colleagues and nearly 36,500 physicians and clinicians caring for diverse communities across 27 states. Nationally recognized for care and experience, our system includes 101 hospitals, 126 continuing care locations, the second largest PACE program in the country, 136 urgent care locations, and many other health and well-being services.

Based in Livonia, Michigan, in fiscal year 2023, we invested $1.5 billion in our communities through charity care and other community benefit programs. For more information, visit http://www.trinity-health.org. You can also follow Trinity Health on LinkedIn.