Z/os Security Cybersecurity Jobs

1 job found

Today

Mainframe and Web Application Security Senior Engineer - Senior Penetration Tester

Information Technology Senior Management Forum Charlotte, NC

Charlotte, NC

Today

$140k - $180k/yr Full time Senior Cics Security Cybersecurity Tools

Apply Now

Job Description

Onsite in Charlotte, NC with a compensation range of $140,000 to $180,000 annually. This role focuses on improving how security testing covers enterprise z/OS and mainframe environments, while partnering with teams to validate remediation and strengthen repeatable offensive testing practices.

Benefits

Medical insurance
Dental insurance
Vision insurance
Life insurance
Disability insurance
Accidental death and dismemberment
Tax-preferred savings accounts
401k plan
No less than 10 days of vacation during the first year of employment (prorated based on hire date and full-time/part-time status)
10 sick days (also prorated)
Paid holidays
Defined benefit pension plan (depending on position and division)
Restricted stock units (depending on position and division)
Deferred compensation plan (depending on position and division)

Benefits eligibility: All regular teammates working 20 hours or more per week are eligible for benefits, with specific benefits determined by the division.

Responsibilities

Conduct black box, grey box, and assumed breach penetration tests of enterprise z/OS, including coverage across USS (Unix System Services) and security subsystems such as RACF, ACF2, and Top Secret.
Test core mainframe workloads and interfaces including CICS, IMS, db2, MQ, plus batch processing components such as JCL and JES2, and TSO/ISPF.
Assess network-facing services including TN3270, FTP, Z/OS Connect, Rest APIs, and NJE.
Apply manual techniques and custom scripting using REXX, JCL, Assembler, and Python, along with offensive tooling to enumerate users and resources, map datasets, assess access to unprotected spool and job output, and exploit misconfigured CICS transactions and insecure interfaces.
Evaluate exploitability and business impact, applying judgment to determine finding severity and risk.
Document findings with clear reproduction steps, supporting evidence, impact statements, and practical remediation recommendations.
Present and defend technical findings to application teams, mainframe engineers, technology leaders, risk partners, and other stakeholders.
Perform validation and retesting to confirm remediation and risk reduction, and maintain testing evidence to support audit, regulatory, and compliance requirements including PCI DSS and SOX.
Partner with internal and external testing teams to improve mainframe testing coverage, methodologies, playbooks, tooling, automation, and repeatable processes.
Conduct peer reviews of penetration testing reports and provide technical guidance and mentorship to other security professionals.
Maintain current knowledge of mainframe attack techniques, security controls, platform changes, offensive security practices, and relevant industry threats.

Requirements

Bachelor’s degree or equivalent education, training, and work-related experience.
Minimum of 7 years of experience in security engineering or related cybersecurity roles.
Deep specialized knowledge of cybersecurity principles, theories, and concepts.
Proven experience with software development lifecycle security practices.
Deep knowledge of threat modeling, security testing, and penetration testing.
Experience implementing and managing complex information security technologies.

Preferred Qualifications

Five or more years of penetration testing, red team, offensive security, vulnerability research, or related cybersecurity experience.
Hands-on experience assessing mainframe environments, including z/OS and security components such as RACF, ACF2, or Top Secret.
Knowledge of mainframe architecture, identity and access management, privileged access, JCL, TSO/ISPF, CICS, Db2, network services, system configuration, and security hardening.
Experience identifying and validating mainframe vulnerabilities, misconfigurations, excessive access, insecure interfaces, and attack paths between mainframe and distributed environments.
Strong technical writing and communication skills, including the ability to explain and defend technical findings to technical and non-technical audiences.
Ability to independently manage multiple testing engagements, adjust approach as priorities and requirements evolve, and drive work to completion.
Experience developing scripts, automation, or AI-enabled tooling that streamlines testing and improves repeatable process efficiency.
Experience in banking, financial services, or another highly regulated industry.
Relevant offensive security certifications such as OSCP, OSEP, OSWE, GPEN, GXPN, or equivalent credentials.

Technology Focus

z/OS, USS, RACF, ACF2, Top Secret
CICS, IMS, db2, MQ
JCL, JES2, TSO/ISPF
TN3270, FTP, Z/OS Connect, Rest APIs, NJE
REXX, Assembler, Python
PCI DSS, SOX
OSCP, OSEP, OSWE, GPEN, GXPN

View full job page →

Get Z/os Security Cybersecurity Jobs alerts

New Z/os Security Cybersecurity Jobs, daily.