Find The RightJob.

Principal Penetration Tester

Description

Principal Penetration Tester

Locations: This role will require an on-site hybrid work schedule in one of our primary organizational hubs including: Johnston, RI - Pittsburgh, PA - Phoenix, AZ - Westwood or Medford, MA - Plano, TX - Iselin, NJ - Franklin, TN

Role Summary
The Principal Penetration Tester is responsible for strengthening internal security assurance across enterprise technology environments through independent, compliance focused security testing. This role evaluates the design and operating effectiveness of security controls, identifies gaps against regulatory, policy, and risk requirements, and supports audit and regulatory readiness. The position also plays a key role in building and maturing a centralized internal security testing capability with defensible, repeatable outcomes.

Position Overview
This role is centered on internal security and compliance testing, with emphasis on assessing control effectiveness, validating controls through realistic threat scenarios, and producing clear, audit ready results that inform leadership decisions and remediation priorities.

Key Responsibilities

Plan, execute, and analyze regulatory and internal security testing across applications, cloud platforms, infrastructure, and endpoint environments
Evaluate security control effectiveness using threat informed methodologies that consider adversary behavior, attack techniques, and architectural context
Perform scenario based testing to validate controls under realistic operating conditions
Analyze findings and deliver clear, actionable reporting aligned to business and risk impact
Partner with technology owners to support remediation planning and validation testing
Coordinate with internal and external testing teams to manage execution risks and dependencies
Support internal audit and regulatory examinations by providing testing results, evidence, and assessments
Partner with leadership to build, formalize, and mature a centralized internal security testing program and governance model
Mentor and provide technical guidance to other security testing resources
Contribute to metrics, dashboards, and reporting that demonstrate control maturity and risk reduction
Identify opportunities to improve efficiency through automation of testing and evidence collection

Required Experience and Skills

10+ years of cybersecurity experience with strong focus on security control testing, assurance, or risk based security assessments
Proven experience evaluating security controls across cloud, application, network, and infrastructure environments
Strong working knowledge of security frameworks and standards such as NIST, ISO, CIS, OWASP, CVSS, and internal risk models
Experience supporting internal audit activities, regulatory examinations, or compliance programs
Demonstrated ability to design defensible test plans, evaluate evidence, and assess control design and operating effectiveness
Strong written communication skills with experience producing audit ready documentation and executive level reporting
Ability to collaborate and influence across engineering, risk, audit, and compliance stakeholders

Preferred Experience

Experience in highly regulated enterprise environments such as financial services
Familiarity with secure development practices and DevSecOps control validation
Experience automating security testing or evidence collection using scripting or security tooling

Education and Certifications

Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related field
Preferred certifications include GPEN, CISSP, CISA, OSCP, or equivalent

Pay Transparency

The salary range for this position is $150,000-$170,000 per year plus an opportunity to earn an annual discretionary bonus. Actual pay is based on various factors including but not limited to the work location, and relevant skills and experience.

We offer competitive pay, comprehensive medical, dental and vision coverage, retirement benefits, maternity/paternity leave, flexible work arrangements, education reimbursement, wellness programs and more. Note, Citizens’ paid time off policy exceeds the mandatory, paid sick or paid time-away policy of very local and state jurisdiction in the United States. For an overview of our benefits, visit https://jobs.citizensbank.com/benefits.

#LI-Citizens1

Some job boards have started using jobseeker-reported data to estimate salary ranges for roles. If you apply and qualify for this role, a recruiter will discuss accurate pay guidance.

Equal Employment Opportunity

Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague’s or a dependent’s reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws. At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.

Background Check

Any offer of employment is conditioned upon the candidate successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results of the background check are individually reviewed based upon legal requirements imposed by our regulators and with consideration of the nature and gravity of the background history and the job offered. Any offer of employment will include further information.