Intermountain Healthcare is seeking a senior penetration testing professional to design, engineer, analyze, and assess key components of its cybersecurity program. This role emphasizes offensive security and penetration testing across enterprise environments, including detailed reporting and stakeholder communication.
Role Summary
The Senior Cybersecurity Penetration Tester plans and executes advanced penetration testing engagements, analyzes results beyond automated scoring, and produces clear documentation of scope, methodology, evidence, findings, risk, and remediation recommendations. The position also involves presenting demonstrated attack scenarios and working with technical teams to validate corrective actions.
Responsibilities
- Plan, scope, and independently execute complex penetration testing engagements across enterprise networks, applications, APIs, cloud environments, identity platforms, and other technology environments.
- Conduct advanced penetration testing using both manual and automated techniques to identify vulnerabilities, configuration weaknesses, attack paths, and potential routes to unauthorized access, privilege escalation, lateral movement, or compromise.
- Perform application and API security testing, including authentication, authorization, session management, input validation, and business logic using established methodologies and industry practices.
- Carry out network and infrastructure penetration testing across internal and external environments, including reconnaissance, enumeration, exploitation, privilege escalation, lateral movement, and post-exploitation activities within approved boundaries.
- Execute adversary simulation, assumed-breach exercises, and targeted security assessments to evaluate preventive, detective, and responsive controls against realistic attack techniques.
- Develop and maintain penetration testing methodologies, procedures, playbooks, testing standards, and repeatable approaches to support consistent, defensible assessments.
- Research emerging vulnerabilities, exploitation techniques, attacker tradecraft, and security technologies, and apply relevant findings to testing activities.
- Develop and use scripts, automation, and offensive security tooling to improve testing effectiveness, coverage, repeatability, and efficiency.
- Analyze vulnerabilities to determine exploitability, attack paths, compensating controls, and potential business impact, rather than relying solely on automated vulnerability severity ratings.
- Produce technically accurate penetration testing reports covering scope, methodology, evidence, findings, risk, exploitation results, and actionable remediation recommendations.
- Communicate technical findings and demonstrated attack scenarios to technical teams, cybersecurity leadership, application owners, infrastructure teams, and other stakeholders at an appropriate technical depth.
- Partner with application, infrastructure, cloud, identity, and cybersecurity teams to validate findings, provide remediation guidance, and perform retesting to confirm corrective actions.
- Act as a senior technical resource for penetration testing and offensive security efforts, including technical guidance, peer review, and support for other cybersecurity professionals.
- Review penetration testing evidence and findings for technical accuracy, reproducibility, appropriate risk characterization, and reporting quality.
- Provide technical guidance and mentoring to less experienced penetration testers and cybersecurity professionals, and assist in developing offensive security capabilities across the team.
- Support security incident response and threat-driven investigations when advanced offensive security expertise, exploitation analysis, or attack-path validation is required.
- Ensure testing activities are properly authorized, scoped, documented, and conducted according to organizational policies, rules of engagement, applicable regulatory requirements, and established procedures.
- Prioritize and complete multiple penetration testing engagements and technical assignments independently with minimal oversight.
Requirements
- Bachelor’s degree through an accredited institution or an intermediate level cybersecurity certification, such as SANS 500+ Series, CISA, or CISM
- 5–8 years of related work experience
- Experienced skills in cybersecurity technologies, systems, and processes
- Advanced troubleshooting skills
- Experienced judgment and decision-making, with strong attention to detail and problem resolution skills
- Advanced skills in communication, presentation, and collaboration
- Advanced cybersecurity certification such as CISSP or SANS 500+ series
- Experienced in attestation and certification methodologies, such as SOC2
- Experienced in scripting and automation
- Experienced understanding of cybersecurity assessment tools and techniques
- Ability to communicate information with others
- Ability to operate computers and other IT equipment, including the ability to move fingers and hands
- Ability to see and read computer monitors and documents
- Ability to remain seated or standing for long periods to perform work on a computer, telephone, or other equipment
Compensation and Schedule
- Hourly range: $49.24 - $77.53
- Scheduled weekly hours: 40
- Hourly salary range: USD 49 - 77 per hour
Location and Work Setup
- Onsite location: West Valley City, UT
- Work city: West Valley City
- Work state: Utah
- Location: Lake Park Building
Benefits
The position includes a generous benefits package supporting a sustainable culture of wellness, encompassing living healthy, happy, secure, connected, and engaged.
