Cloud Security Penetration Tester

This role focuses on planning, leading, and delivering penetration testing activities across multi-cloud environments and cloud-hosted applications. The position emphasizes vulnerability and misconfiguration discovery through both manual and automated techniques, with clear reporting to technical and leadership audiences.

Penetration Testing Responsibilities

• Plan, lead, and conduct penetration tests across multi-cloud environments and cloud-hosted applications.
• Execute manual and automated testing to identify and validate vulnerabilities and misconfigurations, including IAM weaknesses, privilege-escalation paths, insecure trust relationships, and cloud attack paths.
• Develop detailed assessment reports and present findings to technical teams and leadership.
• Lead reporting efforts and collaborate with IT sub-divisions, third-party partners, and business units to assess the impact of technology implementations on IT and business operations.
• Drive the evolution of cloud penetration testing methodologies, tooling, automation, standards, and best practices.
• Maintain subject matter expertise in relevant areas of cloud security.
• Research emerging cloud vulnerabilities, attack techniques, and offensive security tooling.
• Lead evaluation and onboarding of new security tooling, including development of custom tools when needed.
• Participate in special projects and perform other duties as assigned.

Required Qualifications

• Minimum of ten years of related work experience, including at least three years in information security.
• Undergraduate degree in a related field, or an equivalent combination of training and experience.
• Hands-on experience conducting penetration testing or offensive security assessments across multiple cloud platforms.
• Experience performing cloud, web application, and API penetration testing using tools such as Burp Suite, Pacu, Redboto, CloudBrute, ScoutSuite, and Prowler.
• Ability to document and communicate technical vulnerabilities, exploitation scenarios, business impact, and remediation recommendations.

Preferred Certifications

• Preferred industry security certifications such as GIAC Cloud Penetration Tester (GCPN), OffSec Certified Professional (OSCP), GIAC Penetration Tester (GPEN), OffSec Web Assessor (OSWA), OffSec Web Expert (OSWE), GIAC Web Application Penetration Tester (GWAPT), etc.

Tools and Technologies

• Burp Suite
• Pacu
• Redboto
• CloudBrute
• ScoutSuite
• Prowler

Location and Work Model

Malvern, PA (hybrid).

Sponsorship

Vanguard is not offering visa sponsorship for this position.

How Hybrid Working Supports Collaboration

Vanguard has implemented a hybrid working model for the majority of crew members, designed to balance flexibility with in-person learning, collaboration, and connection.