Lead Penetration Tester
Core
Lead the design, implementation, and scaling of McKesson's Continuous Adversarial Testing (CART) program to strengthen the security posture of the enterprise application ecosystem using AI-enabled security testing and autonomous testing capabilities.
Role type
Senior IC offensive security engineer (AI-enabled penetration testing & program leadership)
Builds
Autonomous security testing capabilities (CART), AI-assisted penetration tests, and integrated security operations workflows for large-scale application portfolios.
Domain
Healthcare + Cybersecurity (Offensive Security / AI Security)
Deliverable
production ML models
Required skills
AI-enabled security testing, web application penetration testing, cloud security assessments, vulnerability validation, autonomous security testing, human-in-the-loop processes, security program governance, DevSecOps, CI/CD security controls, API security, cloud-native application security, executive reporting, technical leadership, mentoring, strategic guidance, program documentation, playbooks, runbooks, stakeholder communications, service metrics, key risk indicators, false-positive rate analysis, testing orchestration, findings validation, remediation coordination, application onboarding, test account management, WAF coordination, rate limiting, emergency stop procedures, security roadmap influence, architecture decisions, security vendor management, LLM integrations, agent-based systems, AI security risks.
Preferred skills
Breach and attack simulation (BAS), automated offensive security capabilities, security technology evaluation, security vendor relationship management, AI-enabled application assessment, DevSecOps implementation, CI/CD security controls, secure software development.
Technologies
CART platforms, autonomous testing platforms, AI-assisted testing tools, WAF, CI/CD pipelines, LLM integrations, agent-based systems.
Responsibilities
Lead the design, implementation, and scaling of the CART program; Develop the CART operating model including governance, intake, prioritization, onboarding, testing cadence, validation, reporting, escalation, and remediation workflows; Establish roles, responsibilities, decision authorities, guardrails, and controls for safe use of autonomous and AI-assisted offensive security technologies; Define application eligibility, readiness, and prioritization criteria; Develop repeatable onboarding processes; Define testing standards and methodologies for web applications, APIs, and cloud-native applications; Establish human-in-the-loop processes for reviewing, reproducing, validating, prioritizing, and communicating findings; Lead the execution of continuous AI-assisted penetration tests; Define quality standards for evidence, reproducibility, severity, exploitability, business impact, false-positive disposition, and finding acceptance; Design integrations between CART platforms and vulnerability management, engineering, reporting, and remediation workflows; Establish service metrics, key risk indicators, and executive reporting; Build mechanisms for measuring false-positive rates, duplicate findings, testing completeness, platform utilization, and actionable vulnerability yield; Evaluate emerging autonomous security testing capabilities and recommend changes to CART strategy, tooling, and service delivery; Create program documentation, playbooks, runbooks, technical standards, training materials, and stakeholder communications; Provide technical leadership, mentoring, and strategic guidance while influencing enterprise security roadmaps, offensive security strategy, and architecture decisions.
Seniority
Senior, hands-on IC with strategic leadership
