Penetration Testing Engineer

Requirements:

• 4+ years of experience in cybersecurity, application security, penetration testing, offensive security, or a related field.
• Bachelors degree or an equivalent combination of education and experience.
• Experience conducting web application and API penetration tests.
• Experience validating vulnerabilities, assessing exploitability, and distinguishing actionable findings from false positives.
• Experience assessing enterprise applications using REST and GraphQL APIs, authentication systems, and cloud-native technologies.
• Working knowledge of security concepts for AWS, Azure, or Google Cloud Platform.
• Experience documenting technical findings and communicating remediation guidance to engineering teams.
• Hands-on experience with Burp Suite Professional, Nuclei, Nmap, Metasploit, Postman, and Kali Linux.
• Preferred: Experience with AI-assisted security tools, security automation platforms, or continuous security testing capabilities.
• Preferred: Experience evaluating and triaging findings from automated or AI-assisted testing platforms, or assessing AI-enabled applications, agent-based systems, LLM integrations, and AI security risks.
• Preferred: Familiarity with DevSecOps, CI/CD security controls, secure development practices, OWASP Top 10, API Security Top 10, threat modeling, and secure design principles.
• Preferred: Background in red teaming, adversarial simulations, attack-path validation, cloud security architecture, containerized environments, or cloud assessments across AWS, Azure, and GCP.
• Preferred: Experience creating security scripts and automation workflows, developing proof-of-concept exploits, or designing adversary emulation scenarios.
• Preferred: Familiarity with security control validation and compliance frameworks; experience mentoring engineers or maturing security programs; or experience in regulated industries such as healthcare or finance.
• Preferred certifications include OSCP, OSWE, OSWA, OSAI, HTB CWES, HTB CWEE, OSEP, GPEN, GWAPT, or equivalent.

Responsibilities:

• Work with a Lead Pentest Engineer to implement McKessons Continuous Adversarial Testing (CART) program across large application portfolios and help establish its operating model.
• Develop repeatable application onboarding processes covering application context, test accounts and data, authentication and authorization, rate limits, WAF coordination, exclusions, maintenance windows, and emergency stop procedures.
• Review, reproduce, validate, prioritize, and communicate findings generated by autonomous testing platforms.
• Support continuous AI-assisted penetration testing of priority enterprise web applications, including onboarding, orchestration, execution oversight, findings validation, and remediation coordination.
• Integrate CART platforms with vulnerability management, engineering, reporting, and remediation workflows.
• Conduct AI-enabled web application, API, and cloud security assessments, along with penetration tests, adversarial assessments, and vulnerability validation for internal and third-party applications.
• Assess emerging autonomous security testing capabilities and recommend improvements to CART strategy, tools, and service delivery.
• Create and maintain program documentation, including playbooks, runbooks, technical standards, and training materials.
• Use automation and AI-assisted security tools to expand testing coverage and improve assessment efficiency.
• Identify and validate complex attack paths involving authentication and authorization weaknesses, business logic flaws, and multi-stage exploitation.
• Assess REST and GraphQL APIs, cloud-native architectures, and modern authentication technologies.
• Explain findings to engineering teams, help prioritize remediation, and retest fixes.
• Develop and maintain testing methodologies, automation workflows, and security assessment procedures.
• Contribute to incident investigations, threat modeling, and ongoing security improvement initiatives.

Technologies:

• AI
• API
• AWS
• Azure
• CI/CD
• Cloud
• DevSecOps
• GCP
• GraphQL
• Support
• LLM
• Linux
• OWASP
• Postman
• REST
• Security
• WAF
• Web
• Windows

More

We are McKesson, an impact-driven Fortune 10 company working across healthcare to make quality care more accessible and affordable. We foster a culture that supports growth, new ideas, and meaningful contributions to the health and well-being of patients, communities, and our people. Our Pentest Team is seeking a hands-on Penetration Testing Engineer to help strengthen security across our enterprise application ecosystem and advance our offensive security capabilities. The role partners with pentest, engineering, product, cloud, and security teams and helps shape AI-assisted testing and program development. The position is hybrid, with two days per week in the office, and may involve limited travel. We offer competitive compensation based on factors including experience, skills, performance, equity, and market conditions; additional annual bonus or long-term incentive opportunities may be available. The base pay range is $103,900–$173,100. We are an equal opportunity employer and provide reasonable accommodations for applicants with disabilities.

last updated 43 week of 2026