> Markdown version of [/jobs/ext/4462171-lead-penetration-test-engineer](https://www.wearedevelopers.com/jobs/ext/4462171-lead-penetration-test-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Penetration Test Engineer

- **Company:** Sp Global, Inc.
- **Location:** Boston, MA, United States
- **Experience:** Expert
- **Salary:** $135,000.0 - $200,000.0
- **Contract:** Permanent contract
- **Skills:** Java (Programming Language), JavaScript (Programming Language), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Microsoft Azure, Bash Shell, Burp Suite, Cloud Computing, Cloud Computing Security, Computer Programming, Data Integrity, Fuzz Testing, Python (Programming Language), Nmap, Open Source Technology, Open Web Application Security, Windows PowerShell, Software Engineering, SQL Injection, Software Vulnerability Management, Web Applications, Scripting, Software Security, Mitre Att&ck, Cross-Site Scripting (XSS), Metasploit, Nessus, Static Application Security Testing, Vulnerability Analysis, Golang, Dynamic Application Security Testing
- **Published:** October 6, 2026
- **Apply:** https://www.thejobnetwork.com/job/7e7cdf90-799e-4fe2-bf8d-a9ffe30ef8a4/lead-penetration-test-engineer

## About the Role

We are seeking a Lead Penetration Test Engineer with extensive experience in penetration testing and offensive security. The ideal candidate will conduct penetration tests, re-testing, vulnerability scanning, and threat assessments across diverse environments. This role requires strong offensive security skills combined with cloud and application security expertise to identify vulnerabilities and develop effective mitigation strategies., * Bachelor's degree in Computer Science, Information Systems, or a related field, or equivalent experience.

\n

 * Minimum 8 years of experience in information security with a strong focus on penetration testing, application security, and vulnerability management.

\n

 * Hands-on experience with penetration testing tools (e.g., Burp Suite, Nessus, Metasploit, Nmap) and methodologies (e.g., OWASP Top 10, MITRE ATT&CK, PTES).

\n

 * Expertise in identifying and exploiting common infrastructure and web application vulnerabilities (e.g., XSS, SQL Injection, IDOR).

\n

 * Familiarity with vulnerability classification and scoring frameworks (CVE, CVSS, CWE).

\n

 * Strong scripting or programming skills (e.g., Bash, Python, Go, PowerShell, JavaScript).

\n

 * Experience performing security assessments (DAST, SAST, SCA, credential scanning) and integrating security testing into CI/CD pipelines.

\n

 * Ability to translate complex technical findings into clear, actionable reports and confidently brief cross-functional teams and executives.

\n

 * At least one recognized offensive security certification (OSCP, OSCE3, OSEP, GXPN, GPEN, or CREST CRT/CCT)., n

 * Experience with cloud security across AWS, Azure, or GCP.

\n

 * Knowledge of AI/ML security and adversarial testing methods, including evaluating LLMs and other models for manipulation, evasion, and data integrity risks.

\n

 * Demonstrated involvement in the infosec community (e.g., open-source projects, bug bounties, CVE research, conference talks, or security publications).

\n

 * Experience applying the MITRE ATT&CK Framework to offensive security operations and threat emulation.

\n

 * Familiarity with secure software development practices and the software development lifecycle.

\n

 * Experience with Java application technologies, deployment frameworks, and associated security best practices.

\n

 * Ability to work collaboratively across teams while independently owning deliverables and maintaining accountability to deadlines.