below marketmost similar roles pay hereabove market
This role pays more than
61%
of similar roles. Most pay
$123,600–$171,500
— the blue band above.
At the midpoint, this role pays about
$161k
versus about
$148k
for comparable roles.
Based on 240 similar postings.
Employer
About State Street
State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody
State Street currently has
351 open roles
on FindRole.
Listed pay typically runs
$115,000–$195,944
across 199 roles with salary data.
The Penetration Testing Analyst, Vice President joins the Threat Intelligence and Assurance organization as a senior, hands-on technical authority. This role leads the technical execution of scenario-based testing against high-value systems, owns the validation of remediation fixes, and manages the engagement lifecycle including scoping and rules of engagement. The analyst will challenge external providers on attack paths and MITRE ATT&CK mapping while leading purple team exercises and TTP assessments. Required expertise includes offensive security, Active Directory, Entra ID, and cloud attack techniques across Azure and AWS. Technical skills must include Cobalt Strike, BloodHound, Mimikatz, Metasploit, Kali Linux, and scripting in Python or PowerShell. The role solves the business problem of ensuring technical defensibility of closure decisions and maturing internal testing capabilities within a highly regulated financial services environment.
Lead the technical execution of scenario-based penetration testing against high-value systems and services.
Provide real-time technical guidance during engagements to assess tester activity and judge operational risk.
Challenge external testing providers on attack paths, evidence quality, severity ratings, and MITRE ATT&CK mapping.
Coordinate with engineering teams to turn security findings into clear technical remediation requirements and validation criteria.
Lead the strategy for validating remediation by personally retesting fixes against original attack paths.
Make final technical calls on closure recommendations and present evidence-based reports to senior leadership.
Design and lead targeted TTP assessments and collaborative purple team exercises to validate detection and response controls.
Feed detection and control gaps to Security Operations and track the resulting improvements through validation.
What we're looking for
10 or more years of related experience.
Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
Industry-recognized offensive security certifications such as OSCP, OSEP, OSCE3, CRTO, GXPN, or equivalent.
Extensive hands-on experience in offensive security, such as advanced penetration testing, red teaming, or adversary simulation.
Expert-level practical knowledge of Active Directory and Entra ID attack paths, privilege escalation, lateral movement, credential abuse, EDR evasion, and cloud attack techniques.
Advanced proficiency with offensive tooling and C2 frameworks, plus scripting for custom tooling and automation.
Proven record of leading remediation validation for complex findings and defining closure criteria.
Penetration Testing
Red Teaming
Offensive Security
Python
Bash
PowerShell
Burp Suite
Metasploit
Nmap
Kali Linux
Pentera
Vulnerability Assessment
OWASP
MITRE ATT&CK
CVE
Network Security
Application Security
Linux
Windows