Senior Mainframe and Web Application Security Engineer – Senior Penetration Tester

Truist

. Perform advanced penetration testing and security assessments across enterprise technologies, primarily mainframe environments .

Posted 10/27/2026full-timeRemote • United StatesSenior💰 $140,000 - $180,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in penetration testing and security assessments within mainframe environments, including proficiency in z/OS and associated security components. Capable of effectively communicating technical findings and managing multiple engagements while ensuring compliance with regulatory standards.

Highest-signal resume keywords

Penetration TestingMainframe Security AssessmentCybersecurity PrinciplesOffensive Security CertificationsTechnical Writing

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Penetration TestingSecurity AssessmentsThreat ModelingVulnerability ResearchMainframe ArchitectureRACFACF2Top SecretJCLDb2

Soft Skills

Technical CommunicationMentorshipProject Management

Tools & Technologies

Z/OSCICSTSO/ISPFMQREST APIsAutomation ToolsOffensive Tooling

Certifications & Qualifications

OSCPOSEPOSWEGPENGXPN

Industry Keywords

CybersecurityFinancial ServicesRegulatory CompliancePCI DSSSOX

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Perform advanced penetration testing and security assessments across enterprise technologies, primarily mainframe environments
Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS environments
Assess USS, RACF, ACF2, Top Secret, CICS, IMS, Db2, MQ, JCL, JES2, TSO/ISPF, TN3270, FTP, z/OS Connect, REST APIs, and NJE
Use manual techniques, custom scripting, and offensive tooling to enumerate users and resources, map datasets, access unprotected spool and job output, and exploit misconfigurations and insecure interfaces
Evaluate exploitability and business impact and determine finding severity and risk
Document findings with reproduction steps, evidence, impact statements, and remediation recommendations
Present and defend technical findings to application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders
Perform validation and retesting to confirm remediation and risk reduction
Maintain testing evidence supporting audit, regulatory, and compliance requirements including PCI DSS and SOX
Partner with internal and external testing teams to improve testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes
Perform peer reviews of penetration testing reports and provide technical guidance and mentorship
Maintain current knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats

Requirements

What you’ll need

Bachelor’s degree or equivalent education, training, and work-related experience
Minimum of 7 years of experience in security engineering or related cybersecurity roles
Deep specialized knowledge in cybersecurity principles, theories, and concepts
Proven experience in software development lifecycle security practices
Deep knowledge of threat modeling, security testing, and penetration testing
Experience implementing and managing complex information security technologies
Five or more years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience
Hands-on experience assessing mainframe environments, including z/OS and common security components such as RACF, ACF2, or Top Secret
Knowledge of mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening
Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments
Strong technical writing and communication skills, including the ability to explain and defend technical findings to technical and non-technical audiences
Ability to independently manage multiple testing engagements, adjust approach as priorities and requirements evolve, and drive work to completion
Experience developing scripts, automation, or AI-enabled tooling that streamlines testing activities and improves the efficiency of repeatable processes
Experience in banking, financial services, or another highly regulated industry
Relevant offensive security certifications, such as OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials
English language fluency required
Must not require employer sponsorship for work visa status or employment authorization

Benefits

Comp & perks

Medical insurance
Dental insurance
Vision insurance
Life insurance
Disability insurance
Accidental death and dismemberment coverage
Tax-preferred savings accounts
401k plan
No less than 10 days of vacation during the first year of employment
10 sick days
Paid holidays
Defined benefit pension plan may be available depending on position and division
Restricted stock units may be available depending on position and division
Deferred compensation plan may be available depending on position and division