Lead, Penetration Tester

About this role

Become a part of our caring community

Become a part of our caring community and help us put health first We're hiring the technical leader of our penetration testing practice, a hands-on Lead who sets how we test, raises the bar across the team, and moves us into AI-augmented offensive security. You will not manage people. You will own the craft: the methods, the standards, the hardest engagements, and the adoption of agentic AI tooling that makes the whole team faster and sharper. You'll work alongside (not under) our Associate Director, who leads the people while you lead the testing. This is a 100% remote role on a specialized offensive-security team, penetration testing shoulder-to-shoulder with Red Team, Breach & Attack Simulation, and Bug Bounty. Fridays are for research and development. You'll have Hack The Box Pro Labs and role-based paths, discretionary certification funding, and a conference/training budget.What you'll own

The testing methodology. You set the methods, playbooks, and quality standards the pentest team follows across web, API, thick-client, cloud, mobile, Active Directory / Entra ID, and AI/LLM-powered applications, and you keep them current as attack surfaces change.

The hardest engagements. You scope, lead, and land the most complex penetration tests end-to-end, and you're the escalation point when an engagement hits a wall.

AI-augmented testing adoption. You drive how the team operates and matures agentic AI offensive tooling, raising coverage, triage speed, evidence quality, and repeatability, and you set the rules of engagement and acceptable-use guardrails for AI in our testing.

Functional influence. You advise leadership on the direction of the penetration testing function, partner with the Associate Director on where the practice goes next, and represent testing to architecture, engineering, and incident-response partners.

What you'll do

Set and govern the team's testing methodology, playbooks, and evidence-quality bar; standardize how complex assessments are scoped, executed, and reported.

Lead the most complex penetration tests (web apps, APIs, cloud, AD/Entra ID, AI/LLM applications) with full autonomy, and mentor other testers on technique, without being their manager.

Operate and mature the team's agentic AI offensive tooling: apply it to improve test coverage, triage, and evidence quality; evaluate AI-assisted findings for accuracy, exploitability, and business risk; and feed practitioner requirements back to the Offensive AI Engineering team who build the platform.

Test AI systems: lead adversarial assessments of AI/LLM applications, prompt injection (direct/indirect), jailbreaks, and adversarial techniques, mapped to the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.

Influence the functional strategy: identify gaps in testing coverage and organizational controls, propose new assessment approaches for emerging threats, and shape where the practice invests.

Translate technical findings into business risk for technical and executive stakeholders; lead closing meetings with application owners, security teams, and internal customers.

Support PCI-DSS and other compliance-driven testing obligations at the standard the program requires.

Your first 6–12 months

By 90 days: you've run our most complex active engagements, mapped the current state of our testing methodology, and identified the first standards to raise.

By 6 months: the team is working from methodology and evidence standards you've set; agentic AI tooling is integrated into at least one core testing workflow with measurable coverage or throughput gains.

By 12 months: AI-augmented testing is a normal part of how the team works; you're advising leadership on the multi-quarter direction of the pentest function.

Use your skills to make an impact

Why this role, and why here

Real authority over the craft, you set the methods, not just follow them, and you do it without the overhead of managing people.

A program that's serious about AI, not a buzzword. You'll mature a real team toward AI-augmented testing, backed by a dedicated Offensive AI Engineering team building the tooling you help shape.

A mission that matters, every assessment finds real vulnerabilities before attackers do. Fridays for R&D, HTB Pro Labs, cert funding, conference budget.

What we're looking for You do not need to check every box below. If you're a deep penetration-testing leader who's AI-curious and has started testing AI systems, we want to talk, the AI-platform-building is a separate team's job, not yours. You'll need: 7+ years in penetration testing, ethical hacking, or offensive security operations, with ~2 years leading complex testing programs or technical workstreams (setting methods others follow, not necessarily managing people). Depth across the modern attack surface, web apps, APIs, cloud (AWS/Azure/GCP), and Active Directory / Entra ID, with a track record leading the most complex assessments autonomously. You've attacked AI, hands-on testing of AI/LLM-powered applications (prompt injection, jailbreaks, adversarial techniques), or demonstrated ability to secure emerging AI systems. We care about what you've done, not years on a framework that's only a few years old. You operate agentic AI tooling, or you're eager to. You've used modern AI-assisted or agentic offensive tooling in real engagements and can judge where it helps and where it doesn't, or you're a strong tester ready to adopt it and lead a team's move toward it. Either way, you're excited to mature the practice toward AI-augmented testing. You set the standard, you've owned a testing methodology, playbook, or quality bar that other practitioners worked from, and you can translate deep technical findings into clear business risk for executives. Certifications are a plus, not a gate, e.g. OSCP, OSWE, OSCE3, CPTS, CWEE, or equivalent advanced credentials. Strong pluses (any of these will make…