Lead Penetration Tester

Requirements:

• Experience implementing, operating, or scaling continuous security testing, attack simulation, breach and attack simulation, or automated offensive security capabilities.
• Experience establishing governance, onboarding processes, service-level objectives, success metrics, reporting, and operational workflows for security programs.
• Experience evaluating, validating, and triaging findings from automated or AI-assisted security testing platforms.
• Experience evaluating security technologies and managing relationships with security vendors and service providers.
• Experience assessing AI-enabled applications, agent-based systems, LLM integrations, or AI security risks.
• Familiarity with DevSecOps, CI/CD security controls, and secure software development practices.
• Knowledge of OWASP Top 10, API Security Top 10, threat modeling, and secure design principles.
• Experience supporting regulated industries such as healthcare, finance, or other highly regulated environments.
• Relevant certifications such as OSCP, OSWE, OSWA, OSAI, HTB CWES, HTB CWEE, OSEP, GPEN, GWAPT, or equivalent.
• Knowledge of offensive security automation frameworks and AI-assisted security testing capabilities.
• Experience developing proof-of-concept exploits and adversary emulation scenarios.

Responsibilities:

• Lead the design, implementation, and expansion of our Continuous Adversarial Testing (CART) program across large application portfolios.
• Develop the CART operating model, including service definition, governance, intake, application prioritization, onboarding, testing cadence, validation, reporting, escalation, and remediation workflows.
• Set roles, decision authorities, guardrails, and controls for safe use of autonomous and AI-assisted offensive security tools.
• Define application eligibility, readiness, and prioritization criteria based on business criticality, exposure, data sensitivity, architecture, authentication needs, and regulatory obligations.
• Create repeatable onboarding processes covering application context, test accounts, authentication and authorization, test data, rate limits, WAF coordination, exclusions, maintenance windows, and emergency stop procedures.
• Set testing standards and methods for web applications, APIs, cloud-native applications, and modern application architectures.
• Establish human-review processes to reproduce, validate, prioritize, and communicate findings from autonomous testing platforms.
• Lead continuous AI-assisted penetration testing for high-priority enterprise web applications, including onboarding, orchestration, oversight, finding validation, and remediation coordination.
• Set quality standards for evidence, reproducibility, severity, exploitability, business impact, false-positive handling, and finding acceptance.
• Integrate CART platforms with vulnerability management, engineering, reporting, and remediation workflows.
• Establish service metrics, key risk indicators, and executive reporting on application coverage, onboarding, testing frequency, finding quality, validated risk, remediation, retest outcomes, and program effectiveness.
• Develop ways to measure false-positive rates, duplicate findings, testing completeness, platform utilization, and actionable vulnerability yield.
• Assess emerging autonomous security testing capabilities and recommend updates to CART strategy, tools, and service delivery.
• Produce program documentation, playbooks, runbooks, technical standards, training materials, and stakeholder communications.
• Provide technical leadership, mentoring, and strategic guidance while influencing enterprise security roadmaps, offensive security strategy, and architecture decisions.

Technologies:

• AI
• API
• CI/CD
• Cloud
• DevSecOps
• Support
• LLM
• OWASP
• Security
• WAF
• Web
• Windows

More

We are McKesson, a Fortune 10 healthcare company delivering insights, products, and services to help make quality care more accessible and affordable. We foster a culture of growth, new ideas, and meaningful impact, focused on the well-being of our people and the communities we serve. Our Pentest Team is seeking a Lead Penetration Testing Engineer to strengthen security across our enterprise application ecosystem and advance our offensive security strategy. This hands-on technical leadership role combines program development with advanced testing, validation of AI-generated findings, and operational problem-solving. Limited travel may be required. Hybrid or remote arrangements may be available under company policy; the role involves extended computer use and virtual meetings, and may occasionally support incident response outside standard business hours. We offer a competitive total rewards package, with compensation based on factors such as experience, skills, performance, equity, and location; additional bonus or long-term incentive opportunities may be available.

last updated 43 week of 2026