Lead, Penetration Tester

Become a part of our caring community

Become a part of our caring community and help us put health first
We're hiring the technical leader of our penetration testing practice, a hands-on Lead who sets how we test, raises the bar across the team, and moves us into AI-augmented offensive security. You will not manage people. You will own the craft: the methods, the standards, the hardest engagements, and the adoption of agentic AI tooling that makes the whole team faster and sharper. You'll work alongside (not under) our Associate Director, who leads the people while you lead the testing.
This is a 100% remote role on a specialized offensive-security team, penetration testing shoulder-to-shoulder with Red Team, Breach & Attack Simulation, and Bug Bounty. Fridays are for research and development. You'll have Hack The Box Pro Labs and role-based paths, discretionary certification funding, and a conference/training budget.

What you'll own

• The testing methodology. You set the methods, playbooks, and quality standards the pentest team follows across web, API, thick-client, cloud, mobile, Active Directory / Entra ID, and AI/LLM-powered applications, and you keep them current as attack surfaces change.
• The hardest engagements. You scope, lead, and land the most complex penetration tests end-to-end, and you're the escalation point when an engagement hits a wall.
• AI-augmented testing adoption. You drive how the team operates and matures agentic AI offensive tooling, raising coverage, triage speed, evidence quality, and repeatability, and you set the rules of engagement and acceptable-use guardrails for AI in our testing.
• Functional influence. You advise leadership on the direction of the penetration testing function, partner with the Associate Director on where the practice goes next, and represent testing to architecture, engineering, and incident-response partners.

What you'll do

• Set and govern the team's testing methodology, playbooks, and evidence-quality bar; standardize how complex assessments are scoped, executed, and reported.
• Lead the most complex penetration tests (web apps, APIs, cloud, AD/Entra ID, AI/LLM applications) with full autonomy, and mentor other testers on technique, without being their manager.
• Operate and mature the team's agentic AI offensive tooling: apply it to improve test coverage, triage, and evidence quality; evaluate AI-assisted findings for accuracy, exploitability, and business risk; and feed practitioner requirements back to the Offensive AI Engineering team who build the platform.
• Test AI systems: lead adversarial assessments of AI/LLM applications, prompt injection (direct/indirect), jailbreaks, and adversarial techniques, mapped to the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework.
• Influence the functional strategy: identify gaps in testing coverage and organizational controls, propose new assessment approaches for emerging threats, and shape where the practice invests.
• Translate technical findings into business risk for technical and executive stakeholders; lead closing meetings with application owners, security teams, and internal customers.
• Support PCI-DSS and other compliance-driven testing obligations at the standard the program requires.

Your first 6–12 months

• By 90 days: you've run our most complex active engagements, mapped the current state of our testing methodology, and identified the first standards to raise.
• By 6 months: the team is working from methodology and evidence standards you've set; agentic AI tooling is integrated into at least one core testing workflow with measurable coverage or throughput gains.
• By 12 months: AI-augmented testing is a normal part of how the team works; you're advising leadership on the multi-quarter direction of the pentest function.

Use your skills to make an impact

Why this role, and why here

• Real authority over the craft, you set the methods, not just follow them, and you do it without the overhead of managing people.
• A program that's serious about AI, not a buzzword. You'll mature a real team toward AI-augmented testing, backed by a dedicated Offensive AI Engineering team building the tooling you help shape.
• A mission that matters, every assessment finds real vulnerabilities before attackers do. Fridays for R&D, HTB Pro Labs, cert funding, conference budget.

What we're looking for

You do not need to check every box below. If you're a deep penetration-testing leader who's AI-curious and has started testing AI systems, we want to talk, the AI-platform-building is a separate team's job, not yours.

You'll need:

7+ years in penetration testing, ethical hacking, or offensive security operations, with ~2 years leading complex testing programs or technical workstreams (setting methods others follow, not necessarily managing people).

Depth across the modern attack surface, web apps, APIs, cloud (AWS/Azure/GCP), and Active Directory / Entra ID, with a track record leading the most complex assessments autonomously.

You've attacked AI, hands-on testing of AI/LLM-powered applications (prompt injection, jailbreaks, adversarial techniques), or demonstrated ability to secure emerging AI systems. We care about what you've done, not years on a framework that's only a few years old.

You operate agentic AI tooling, or you're eager to. You've used modern AI-assisted or agentic offensive tooling in real engagements and can judge where it helps and where it doesn't, or you're a strong tester ready to adopt it and lead a team's move toward it. Either way, you're excited to mature the practice toward AI-augmented testing.

You set the standard, you've owned a testing methodology, playbook, or quality bar that other practitioners worked from, and you can translate deep technical findings into clear business risk for executives.

Certifications are a plus, not a gate, e.g. OSCP, OSWE, OSCE3, CPTS, CWEE, or equivalent advanced credentials.

Strong pluses (any of these will make you stand out):

• Building or extending offensive tooling, scripting (Python/PowerShell/Bash/Ruby), custom exploit development, or contributing requirements to agentic AI tooling (multi-agent orchestration, MCP servers, LLM-as-judge) built by the AI-engineering team.
• Deeper adversarial ML, model extraction/inversion, membership inference, data/supply-chain poisoning, and hands-on with PyRIT or Garak.
• Application-security research and exploit development; mobile (iOS/Android); published research or conference talks (DEF CON, Black Hat, BSides).
• Security automation, CI/CD pipeline security testing, and DevSecOps practices.

How you'll work

You'll embed with our testing service lines and set the rigor the team works to. You'll define, with the Associate Director, the acceptable use of AI tooling in engagements and the rules of engagement that keep testing safe and in-scope. You lead the testing craft; the Associate Director leads the people; the Offensive AI Engineering team builds the platform you help mature.

Work at Home Requirements: To ensure Home or Hybrid Home/Office employees’ ability to work effectively, the self-provided internet service of Home or Hybrid Home/Office employees must meet the following criteria: At minimum, a download speed of 25 Mbps and an upload speed of 10 Mbps is required; wireless, wired cable or DSL connection is suggested. In certain roles, the minimum recommended internet speed required by Humana may not be sufficient for business needs. Humana reserves the right to require associates to upgrade their internet service if necessary. Work from a dedicated space lacking ongoing interruptions to protect member PHI / HIPAA information.Travel: While this is a remote position, occasional travel to Humana's offices for training or meetings may be required.

Scheduled Weekly Hours

40

Pay Range

The compensation range below reflects a good faith estimate of starting base pay for full time (40 hours per week) employment at the time of posting. The pay range may be higher or lower based on geographic location and individual pay will vary based on demonstrated job related skills, knowledge, experience, education, certifications, etc.$142,300 - $195,700 per yearThis job is eligible for a bonus incentive plan. This incentive opportunity is based upon company and/or individual performance.

Description of Benefits

Humana, Inc. and its affiliated subsidiaries (collectively, “Humana”) offers competitive benefits that support whole-person well-being. Associate benefits are designed to encourage personal wellness and smart healthcare decisions for you and your family while also knowing your life extends outside of work. Among our benefits, Humana provides medical, dental and vision benefits, 401(k) retirement savings plan, time off (including paid time off, company and personal holidays, paid parental and caregiver leave), short-term and long-term disability, life insurance and many other opportunities.Application Deadline: 08-24-2026

About us

About Humana: Humana Inc. (NYSE: HUM) is a leading U.S. healthcare company. Through our Humana insurance services and our CenterWell healthcare services, we make it easier for the millions of people we serve to achieve their best health – delivering the care and service they need, when they need it. These efforts are leading to a better quality of life for people with Medicare and Medicaid, families, individuals, military service personnel, and communities at large. Learn more about what we offer at Humana.com and at CenterWell.com.

​

Equal Opportunity Employer

It is the policy of Humana not to discriminate against any employee or applicant for employment because of race, color, religion, sex, sexual orientation, gender identity, national origin, age, marital status, genetic information, disability or protected veteran status. It is also the policy of Humana to take affirmative action, in compliance with Section 503 of the Rehabilitation Act and VEVRAA, to employ and to advance in employment individuals with disability or protected veteran status, and to base all employment decisions only on valid job requirements. This policy shall apply to all employment actions, including but not limited to recruitment, hiring, upgrading, promotion, transfer, demotion, layoff, recall, termination, rates of pay or other forms of compensation and selection for training, including apprenticeship, at all levels of employment.

Originally posted on Himalayas