Lead, Penetration Tester

Become a part of our caring community   Become a part of our caring community and help us put health first We're hiring the technical leader of our penetration testing practice, a hands-on Lead who sets how we test, raises the bar across the team, and moves us into AI-augmented offensive security. You will not manage people. You will own the craft: the methods, the standards, the hardest engagements, and the adoption of agentic AI tooling that makes the whole team faster and sharper. You'll work alongside (not under) our Associate Director, who leads the people while you lead the testing. This is a 100% remote role on a specialized offensive-security team, penetration testing shoulder-to-shoulder with Red Team, Breach & Attack Simulation, and Bug Bounty. Fridays are for research and development. You'll have Hack The Box Pro Labs and role-based paths, discretionary certification funding, and a conference/training budget.

The testing methodology. You set the methods, playbooks, and quality standards the pentest team follows across web, API, thick-client, cloud, mobile, Active Directory / Entra ID, and AI/LLM-powered applications, and you keep them current as attack surfaces change. The hardest engagements. You scope, lead, and land the most complex penetration tests end-to-end, and you're the escalation point when an engagement hits a wall. AI-augmented testing adoption. You drive how the team operates and matures agentic AI offensive tooling, raising coverage, triage speed, evidence quality, and repeatability, and you set the rules of engagement and acceptable-use guardrails for AI in our testing. Functional influence. You advise leadership on the direction of the penetration testing function, partner with the Associate Director on where the practice goes next, and represent testing to architecture, engineering, and incident-response partners.

Set and govern the team's testing methodology, playbooks, and evidence-quality bar; standardize how complex assessments are scoped, executed, and reported. Lead the most complex penetration tests (web apps, APIs, cloud, AD/Entra ID, AI/LLM applications) with full autonomy, and mentor other testers on technique, without being their manager. Operate and mature the team's agentic AI offensive tooling: apply it to improve test coverage, triage, and evidence quality; evaluate AI-assisted findings for accuracy, exploitability, and business risk; and feed practitioner requirements back to the Offensive AI Engineering team who build the platform. Test AI systems: lead adversarial assessments of AI/LLM applications, prompt injection (direct/indirect), jailbreaks, and adversarial techniques, mapped to the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework. Influence the functional strategy: identify gaps in testing coverage and organizational controls, propose new assessment approaches for emerging threats, and shape where the practice invests. Translate technical findings into business risk for technical and executive stakeholders; lead closing meetings with application owners, security teams, and internal customers. Support PCI-DSS and other compliance-driven testing obligations at the standard the program requires. Your first 6–12 months By 90 days: you've run our most complex active engagements, mapped the current state of our testing methodology, and identified the first standards to raise. By 6 months: the team is working from methodology and evidence standards you've set; agentic AI tooling is integrated into at least one core testing workflow with measurable coverage or throughput gains. By 12 months: AI-augmented testing is a normal part of how the team works; you're advising leadership on the multi-quarter direction of the pentest function. Use your skills to make an impact   Why this role, and why here Real authority over the craft, you set the methods, not just follow them, and you do it without the overhead