Senior Cybersecurity Penetration Tester

Job Description:

The Intermountain Cybersecurity Program is broken into four distinct functions: Governance Risk and Compliance, Cyber Solutions, Cyber Advisory and the Cyber Fusion Center. Cyber Caregivers within Intermountain will specialize in their specific area and function.

The Cybersecurity-Senior is responsible for designing, engineering, analyzing and/or assessing key elements of Intermountain’s cybersecurity program. Caregivers within this job code will support one of the following aspects of the cyber program: governance, risk and compliance activities, identity and access management, data, endpoint and application security, infrastructure and network security, cyber architecture and standards, reporting and analytics, project management and business liaising.

Senior-level professionals are experienced in all aspects of cybersecurity and/or IT systems. Typically designs and develops approaches that are implemented by others. Functions independently with minimal oversight and direction. May instruct and guide lower level technical professionals.The hiring manager is considering candidates with experience in offensive security, penetration testing, ethical hacking, red team operations, vulnerability assessments, or related cybersecurity disciplines. Ideal candidates will have experience using industry-standard penetration testing and security assessment tools, conducting web application and network testing, identifying and validating vulnerabilities, and communicating findings through clear technical reports and stakeholder presentations. Experience with scripting, hardware or IoT security testing, social engineering assessments, recognized security certifications, and security-cleared environments is a plus.

Essential Functions

• Plans, scopes, and independently executes complex penetration testing engagements across enterprise networks, applications, APIs, cloud environments, identity platforms, and other technology environments.
• Performs advanced penetration testing using manual and automated techniques to identify vulnerabilities, configuration weaknesses, attack paths, and opportunities that could allow unauthorized access, privilege escalation, lateral movement, or compromise of sensitive systems and data.
• Conducts application and API security testing, including authentication, authorization, session management, input validation, business logic, and other security controls using established penetration testing methodologies and industry practices.
• Performs network and infrastructure penetration testing against internal and external environments, including reconnaissance, enumeration, exploitation, privilege escalation, lateral movement, and post-exploitation activities within authorized engagement boundaries.
• Conducts adversary simulation, assumed-breach exercises, and targeted security assessments to evaluate the effectiveness of preventive, detective, and responsive security controls against realistic attack techniques.
• Develops and maintains penetration testing methodologies, procedures, playbooks, testing standards, and repeatable approaches to ensure consistent and defensible security assessments.
• Researches emerging vulnerabilities, exploitation techniques, attacker tradecraft, and security technologies and applies relevant techniques to penetration testing activities.
• Develops and uses scripts, automation, and offensive security tooling to improve testing effectiveness, coverage, repeatability, and efficiency.
• Analyzes identified vulnerabilities to determine exploitability, attack paths, compensating controls, and potential business impact rather than relying solely on automated vulnerability severity ratings.
• Produces clear and technically accurate penetration testing reports documenting scope, methodology, evidence, findings, risk, exploitation results, and actionable remediation recommendations.
• Communicates technical findings and demonstrated attack scenarios to technical teams, cybersecurity leadership, application owners, infrastructure teams, and other stakeholders at an appropriate level of technical detail.
• Partners with application, infrastructure, cloud, identity, and cybersecurity teams to validate findings, provide remediation guidance, and perform retesting to confirm corrective actions are effective.
• Serves as a senior technical resource for penetration testing and offensive security activities, providing technical guidance, peer review, and support to other cybersecurity professionals.
• Reviews penetration testing evidence and findings for technical accuracy, reproducibility, appropriate risk characterization, and reporting quality.
• Provides technical guidance and mentoring to less experienced penetration testers and cybersecurity professionals and assists in developing offensive security capabilities across the team.
• Supports security incident response and threat-driven investigations when advanced offensive security expertise, exploitation analysis, or attack-path validation is required.
• Ensures penetration testing activities are properly authorized, scoped, documented, and conducted in accordance with organizational policies, rules of engagement, applicable regulatory requirements, and established testing procedures.
• Effectively prioritizes and executes multiple penetration testing engagements and technical assignments while operating independently with minimal oversight.

Qualifications

Minimum Qualifications

• Bachelor’s degree through an accredited institution or Intermediate level cybersecurity certification, such as SANS 500+ Series, CISA, or CISM
• 5-8 years of related work experience
• Experienced skills in cybersecurity technologies, systems and processes
• Advanced Troubleshooting skills
• Experienced skill in analysis, attention to detail, problem resolution, judgment, and decision-making
• Experienced skill in communication, presentation, and collaboration

Preferred Qualifications

• Advanced cybersecurity certification such as a CISSP or SANS 500+ series
• Depending on the roles focus:
• Experienced attestation and certification methodologies, such as SOC2
• Experienced in scripting and automation
• Experienced understanding cybersecurity assessment tools/techniques​

Physical Requirements

• Interact with others requiring the employee to communicate information.
• Operate computers and other IT equipment requiring the ability to move fingers and hands.
• See and read computer monitors and documents.
• Remain sitting or standing for long periods of time to perform work on a computer, telephone, or other equipment.

Location:

Lake Park Building

Work City:

West Valley City

Work State:

Utah

Scheduled Weekly Hours:

40 The hourly range for this position is listed below. Actual hourly rate dependent upon experience. $49.24 - $77.53 We care about your well-being – mind, body, and spirit – which is why we provide our caregivers a generous benefits package that covers a wide range of programs to foster a sustainable culture of wellness that encompasses living healthy, happy, secure, connected, and engaged.

Learn more about our comprehensive benefits package here.

By applying for a position with Intermountain, I acknowledge that I will comply with all applicable Intermountain policies and expectations. If applying for a remote or hybrid role, this includes remote work expectations related to confidentiality, information security, work schedules, conflicts of interest, and use of company equipment. I further acknowledge that outside employment or activities may not interfere with job responsibilities or create a conflict of interest with Intermountain. Actual or reasonably perceived conflicts may be grounds for disqualification from consideration or, if hired, corrective action up to and including termination of employment.

Intermountain Health is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.

At Intermountain Health, we use the artificial intelligence ("AI") platform, HiredScore to improve your job application experience. HiredScore helps match your skills and experiences to the best jobs for you. While HiredScore assists in reviewing applications, all final decisions are made by Intermountain personnel to ensure fairness. We protect your privacy and follow strict data protection rules. Your information is safe and used only for recruitment. Thank you for considering a career with us and experiencing our AI-enhanced recruitment process.

All positions subject to close without notice.