Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted today

Penetration Testing Analyst, Vice President

State Street1,147 open roles

Where
Quincy Massachusetts
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowPenetration Testing Analyst, Vice PresidentState Street · Quincy Massachusetts

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on State Street's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

9.8% of postings close within 7 days. Measured by our own scanner across the market. State Street postings stay open a median of 30 days.

Share of postings closed within
  1. 1.9%1 day
  2. 3.9%3 days
  3. 9.8%7 days
  4. 15.6%14 days
  5. 33.8%30 days
This job: posted today

State Street median: 30 days open

The posting

Penetration Testing Analyst, Vice President

Who we are looking for

We are seeking a Vice President, Penetration Testing Analyst, to join State Street's Threat Intelligence and Assurance organization. This is a senior, hands-on technical role and serves as the team's in-house technical authority for complex penetration testing engagements and for validating remediation.

Why this role is important to us

You will lead the technical execution of scenario-based testing against high-value systems and services, and you will own the validation of fixes for the resulting findings. Working with finding owners, offensive security partners, external testing providers, security operations, and risk and regulatory partners, you will make sure testing is realistic, findings are technically sound, and every fix holds up under real-world attack conditions. You will be accountable for the technical defensibility of closure decisions presented to senior leadership and the Lines of Defense. You will also help mature a repeatable, high-quality internal testing capability.

What you will be responsible for

As a Vice President, Penetration Testing Analyst, you will:

  • Serve as the senior technical lead across the engagement lifecycle, including scoping, test planning, rules of engagement, execution oversight, and post-test remediation planning.
  • Provide real-time technical guidance during engagements by assessing tester activity, judging operational risk, and guiding escalation decisions with appropriate discretion.
  • Hold external testing providers to a high technical standard by challenging their attack paths, evidence quality, severity ratings, and MITRE ATT&CK mapping, so that results are accurate, actionable, and defensible.
  • Lead coordination with finding owners and engineering teams to turn findings into clear technical remediation requirements and measurable validation criteria, so fixes address root causes rather than narrow point issues.
  • Lead the strategy for validating remediation. This includes grouping related findings, defining test criteria and expected outcomes, and personally retesting fixes against the original attack path and other ways of reaching the same objective.
  • Assess remediation across the wider estate, including variant attack paths, implementation consistency, and any new exposure the fix itself introduces.
  • Make the final technical call on closure recommendations, backed by evidence-based reporting that confirms each finding as closed, open, or partially closed, with executive summaries for senior and non-technical audiences.
  • Present testing and validation outcomes to senior leadership and governance forums, and defend the technical basis for findings, residual risk, and closure decisions.
  • Design and lead targeted TTP assessments and collaborative purple team exercises, so that detection, response, and preventive controls are validated against relevant attacker behavior.
  • Feed detection and control gaps found during testing to Detection Engineering, Assurance, and Security Operations, and track the resulting improvements through validation.
  • Provide offensive security support to partner teams, including risk and regulatory functions, and help set the methods, test plans, evidence standards, and lessons-learned practices that mature the internal capability. You will also mentor team members and partners.

What we value

These skills will help you succeed in this role:

  • Extensive hands-on experience in offensive security, such as advanced penetration testing, red teaming, or adversary simulation, ideally in financial services or another highly regulated industry.
  • Expert-level practical knowledge of Active Directory and Entra ID attack paths, privilege escalation, lateral movement, credential abuse, EDR evasion, and cloud attack techniques across Azure and AWS.
  • Advanced proficiency with offensive tooling and C2 frameworks, such as Cobalt Strike, BloodHound, Mimikatz, Metasploit, and Kali Linux, plus scripting for custom tooling and automation (Python, PowerShell, or similar).
  • A proven record of leading remediation validation for complex findings, including defining closure criteria and deciding whether controls work in practice rather than just on paper.
  • Deep working knowledge of MITRE ATT&CK, scenario-based test design, and how detection and response capabilities are measured during testing.
  • Experience directing and challenging third-party testing providers, with the judgment to separate exploitable risk from theoretical findings.
  • Executive-level written and verbal communication, with the ability to defend technical conclusions to senior leadership, governance bodies, and independent reviewers.
  • Discretion and sound judgment when handling sensitive, confidential engagement information.

Education & Preferred Qualifications

  • Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
  • 10 or more years of related experience
  • Industry-recognized offensive security certifications such as OSCP, OSEP, OSCE3, CRTO, GXPN, or equivalent.
  • Experience supporting large-scale remediation validation programs is strongly preferred.

Salary Range:

$120,000 - $202,500 Annual

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a full overview, visit https://hrportal.ehr.com/statestreet/Home.

About State Street

Across the globe, institutional investors rely on us to help them manage risk, respond to challenges, and drive performance and profitability. We keep our clients at the heart of everything we do, and smart, engaged employees are essential to our continued success.

We are committed to fostering an environment where every employee feels valued and empowered to reach their full potential. As an essential partner in our shared success, you’ll benefit from inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks that keep you connected to what matters most. Join us in shaping the future.

As an Equal Opportunity Employer, we consider all qualified applicants for all positions without regard to race, creed, color, religion, national origin, ancestry, ethnicity, age, disability, genetic information, sex, sexual orientation, gender identity or expression, citizenship, marital status, domestic partnership or civil union status, familial status, military and veteran status, and other characteristics protected by applicable law.

Discover more information on jobs at StateStreet.com/careers

Read our CEO Statement

Job Application Disclosure:

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against State Street's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on State Street's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    State Street's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.