International Information Systems Security Certification Consortium
Overview Your Future. Secured. ISC2 is a force for good. As the world's leading nonprofit member organization for cybersecurity professionals, our core values - Integrity, Advocacy, Commitment, Inclusion, and Excellence - drive everything we do in support of our vision of a safe and secure cyber world. Our globally recognized, award-winning portfolio of certifications provide an independent and globally recognized endorsement of cybersecurity knowledge, skills and experience for all career levels. Our charitable arm, the Center for Cyber Safety and Education, enables ISC2 and our members to serve the public by educating the most vulnerable about cyber risks and empowering access to enter and thrive in the cyber profession. Learn more at ISC2 online and connect with us on Twitter, Facebook and LinkedIn. When you join ISC2, you'll demonstrate your commitment to an inclusive and equitable environment. Your support of the unique perspectives and experiences shared by our global cybersecurity workforce and profession will be recognized. We invite you to take an active role in helping us create a true sense of belonging across our organization - an environment of authenticity, trust, empowerment and connectedness that empowers all of our successes. Learn more. Position Summary The Security Engineer, Penetration Testing is a dual-function role responsible for both executing offensive security assessments and building the defensive engineering controls that harden ISC2's environment. The role leads authorized penetration testing across ISC2's applications, networks, and cloud infrastructure while also owning security engineering work - including security architecture review, tooling, automation, and control implementation - that translates findings into lasting improvements. This position works closely with the Security and Technical Operations team and collaborates across IT, engineering, and product to continuously strengthen ISC2's security posture. The role plays a critical part in supporting ISC2's ISO/IEC 27001:2022 ISMS program, providing both evidence of technical control effectiveness and direct input into risk treatment. Responsibilities Penetration Testing Plan, execute, and document internal and external penetration tests against ISC2 applications, networks, cloud environments, and infrastructure. Perform vulnerability assessments andvalidatefindings to distinguish genuine risks from false positives. Conduct web application, API, mobile, and network vulnerability assessments using industry-standard methodologies (OWASP, PTES, OSSTMM). Perform social engineering assessments, including phishing simulations and physical security testing as authorized. Produce clear, actionable written reports detailing findings, risk ratings, evidence, and remediation recommendations tailored to both technical and executive audiences. Support red team exercises and adversary simulation activities to test detection and response capabilities. Develop andmaintainthe penetration testing program, including scope definitions, rules of engagement, and testing schedules.Move towards a continuous testmindset and method. Coordinate with third-party security vendors for external assessments and bug bounty program management where applicable. Security Engineering Own remediation follow-through: translate pen test findings into security engineering work items,validatefixes, and track resolution to closure in Jira Service Management. Design and implement security controls across ISC2's cloud and on-premises environments, including hardening configurations for Azure, Okta, SentinelOne, CheckPoint, and F5 XD. Participate in security architecture and design reviews for new systems, integrations, and third-party products; provide security requirements and risk acceptance recommendations. Develop and maintain security automation scripts and tooling to improve detection coverage, reduce manual effort in assessment workflows, and support continuous monitoring. Support the Secure Software Development Lifecycle (SSDLC), including security requirements definition, code review support, and pre-deployment security validation. Maintain awareness of emerging vulnerabilities, exploits, and threat actor TTPs; operationalize threat intelligence into actionable hardening and detection improvements. Support ISC2's ISO/IEC 27001:2022 ISMS by providing technical evidence and input for Annex A controls spanning vulnerability management (A.8.8), secure development (A.8.25-A.8.29), and technical review (A.8.29). Miscellaneous duties as assigned. Behavioral Competencies Integrity & Ethics:Operateswith the highest standard of professional ethics; treats privileged access, sensitive findings, and organizational data with strict confidentiality. Analytical Thinking: Applies a structured, adversarial mindset to both offensive assessments and defensive design; bridges exploit research with practical engineering solutions. Communication: Clearly articulates complex technical vulnerabilities and risk in written reports and verbal briefings to both technical and non-technical stakeholders. Collaboration: Partners effectively with developers, architects, and operations staff to drive meaningful security improvements without disrupting business operations. Continuous Learning: Actively pursues knowledge of emerging threats, tools, and techniques; contributes insights to team knowledge sharing. Qualifications Proficiency with penetration testing tools including Burp Suite, Metasploit, Nmap, Nessus, CobaltStrike, andsimilar offensive frameworks. Strong understanding of web application vulnerabilities (OWASP Top 10), network protocols, Active Directory attack paths, and cloud security (Azure, AWS, GCP). Effective written and verbal communication with cross-functional teams is essential. Scripting and automationproficiencyin Python, Bash, or PowerShell; ability to write ormodifyexploit code as well as defensive tooling. Familiarity with MITRE ATT&CK, CVSS, CVE, NIST SP 800-115, and the CIS Benchmarks for secure configuration baselines. Posess AI literacy and ability to test Ai workloads and infrastructures. Relevant certifications strongly preferred: OSCP, GPEN or GWAPT, plus one engineering/architecture credential (CISSP, CSSLP, or equivalent). ISC2 membership or certifications (CISSP, CC) are a plus and demonstratealignment with ISC2's mission. Education and Work Experience Bachelor's degree in Computer Science, Information Security, Cybersecurity, orrelated field. Will consider candidates with a high school diploma or regional equivalent and at least eight (8) years of experience in cybersecurity. 4+ years of experience in cybersecurity, with a demonstrable mix of offensive security (penetration testing) and defensive/engineering work (control implementation, architecture review, or SSDLC). Experience with IAM security, including Okta and SAML/OAuth-based environments, both for testing and hardening purposes. Security engineering experience implementing and hardening controls across cloud and identityplatforms (Azure, Okta, SentinelOne, endpoint security tooling). Experience supporting ISO/IEC 27001, SOC 2, PCI-DSS, or similar compliance programs is a plus. Physical and Mental Demands Ability to travel up to 5% of the time. Work normal business hours and extended hours when necessary. Remain in a stationary position, often standing or sitting, for prolonged periods. The role requires the ability to work at a computer for extended periods and communicate effectively through written and verbal channels. Regular use of office equipment such as a computer/laptop and monitor computer screens. Dexterity of hands and fingers to operate a computer keyboard, mouse, and other computer components. Total Rewards The pay range for this position is £50,550 - £64,729/Yr. Final pay is based on several factors including but not limited to internal equity, market data, and the applicant's education, work experience, certifications, etc. Information regarding our comprehensive benefits package is availablehere. This position will be posted for a minimum of 5 calendar days. This is a current vacancy, and the employer intends to fill this position within approximately 30 days. Equal Employment Opportunity Statement All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic as protected by applicable law. Job candidates will not be obligated to disclose sealed or expunged records of conviction or arrest as part of the hiring process.
Overview Your Future. Secured. ISC2 is a force for good. As the world's leading nonprofit member organization for cybersecurity professionals, our core values - Integrity, Advocacy, Commitment, Inclusion, and Excellence - drive everything we do in support of our vision of a safe and secure cyber world. Our globally recognized, award-winning portfolio of certifications provide an independent and globally recognized endorsement of cybersecurity knowledge, skills and experience for all career levels. Our charitable arm, the Center for Cyber Safety and Education, enables ISC2 and our members to serve the public by educating the most vulnerable about cyber risks and empowering access to enter and thrive in the cyber profession. Learn more at ISC2 online and connect with us on Twitter, Facebook and LinkedIn. When you join ISC2, you'll demonstrate your commitment to an inclusive and equitable environment. Your support of the unique perspectives and experiences shared by our global cybersecurity workforce and profession will be recognized. We invite you to take an active role in helping us create a true sense of belonging across our organization - an environment of authenticity, trust, empowerment and connectedness that empowers all of our successes. Learn more. Position Summary The Security Engineer, Penetration Testing is a dual-function role responsible for both executing offensive security assessments and building the defensive engineering controls that harden ISC2's environment. The role leads authorized penetration testing across ISC2's applications, networks, and cloud infrastructure while also owning security engineering work - including security architecture review, tooling, automation, and control implementation - that translates findings into lasting improvements. This position works closely with the Security and Technical Operations team and collaborates across IT, engineering, and product to continuously strengthen ISC2's security posture. The role plays a critical part in supporting ISC2's ISO/IEC 27001:2022 ISMS program, providing both evidence of technical control effectiveness and direct input into risk treatment. Responsibilities Penetration Testing Plan, execute, and document internal and external penetration tests against ISC2 applications, networks, cloud environments, and infrastructure. Perform vulnerability assessments andvalidatefindings to distinguish genuine risks from false positives. Conduct web application, API, mobile, and network vulnerability assessments using industry-standard methodologies (OWASP, PTES, OSSTMM). Perform social engineering assessments, including phishing simulations and physical security testing as authorized. Produce clear, actionable written reports detailing findings, risk ratings, evidence, and remediation recommendations tailored to both technical and executive audiences. Support red team exercises and adversary simulation activities to test detection and response capabilities. Develop andmaintainthe penetration testing program, including scope definitions, rules of engagement, and testing schedules.Move towards a continuous testmindset and method. Coordinate with third-party security vendors for external assessments and bug bounty program management where applicable. Security Engineering Own remediation follow-through: translate pen test findings into security engineering work items,validatefixes, and track resolution to closure in Jira Service Management. Design and implement security controls across ISC2's cloud and on-premises environments, including hardening configurations for Azure, Okta, SentinelOne, CheckPoint, and F5 XD. Participate in security architecture and design reviews for new systems, integrations, and third-party products; provide security requirements and risk acceptance recommendations. Develop and maintain security automation scripts and tooling to improve detection coverage, reduce manual effort in assessment workflows, and support continuous monitoring. Support the Secure Software Development Lifecycle (SSDLC), including security requirements definition, code review support, and pre-deployment security validation. Maintain awareness of emerging vulnerabilities, exploits, and threat actor TTPs; operationalize threat intelligence into actionable hardening and detection improvements. Support ISC2's ISO/IEC 27001:2022 ISMS by providing technical evidence and input for Annex A controls spanning vulnerability management (A.8.8), secure development (A.8.25-A.8.29), and technical review (A.8.29). Miscellaneous duties as assigned. Behavioral Competencies Integrity & Ethics:Operateswith the highest standard of professional ethics; treats privileged access, sensitive findings, and organizational data with strict confidentiality. Analytical Thinking: Applies a structured, adversarial mindset to both offensive assessments and defensive design; bridges exploit research with practical engineering solutions. Communication: Clearly articulates complex technical vulnerabilities and risk in written reports and verbal briefings to both technical and non-technical stakeholders. Collaboration: Partners effectively with developers, architects, and operations staff to drive meaningful security improvements without disrupting business operations. Continuous Learning: Actively pursues knowledge of emerging threats, tools, and techniques; contributes insights to team knowledge sharing. Qualifications Proficiency with penetration testing tools including Burp Suite, Metasploit, Nmap, Nessus, CobaltStrike, andsimilar offensive frameworks. Strong understanding of web application vulnerabilities (OWASP Top 10), network protocols, Active Directory attack paths, and cloud security (Azure, AWS, GCP). Effective written and verbal communication with cross-functional teams is essential. Scripting and automationproficiencyin Python, Bash, or PowerShell; ability to write ormodifyexploit code as well as defensive tooling. Familiarity with MITRE ATT&CK, CVSS, CVE, NIST SP 800-115, and the CIS Benchmarks for secure configuration baselines. Posess AI literacy and ability to test Ai workloads and infrastructures. Relevant certifications strongly preferred: OSCP, GPEN or GWAPT, plus one engineering/architecture credential (CISSP, CSSLP, or equivalent). ISC2 membership or certifications (CISSP, CC) are a plus and demonstratealignment with ISC2's mission. Education and Work Experience Bachelor's degree in Computer Science, Information Security, Cybersecurity, orrelated field. Will consider candidates with a high school diploma or regional equivalent and at least eight (8) years of experience in cybersecurity. 4+ years of experience in cybersecurity, with a demonstrable mix of offensive security (penetration testing) and defensive/engineering work (control implementation, architecture review, or SSDLC). Experience with IAM security, including Okta and SAML/OAuth-based environments, both for testing and hardening purposes. Security engineering experience implementing and hardening controls across cloud and identityplatforms (Azure, Okta, SentinelOne, endpoint security tooling). Experience supporting ISO/IEC 27001, SOC 2, PCI-DSS, or similar compliance programs is a plus. Physical and Mental Demands Ability to travel up to 5% of the time. Work normal business hours and extended hours when necessary. Remain in a stationary position, often standing or sitting, for prolonged periods. The role requires the ability to work at a computer for extended periods and communicate effectively through written and verbal channels. Regular use of office equipment such as a computer/laptop and monitor computer screens. Dexterity of hands and fingers to operate a computer keyboard, mouse, and other computer components. Total Rewards The pay range for this position is £50,550 - £64,729/Yr. Final pay is based on several factors including but not limited to internal equity, market data, and the applicant's education, work experience, certifications, etc. Information regarding our comprehensive benefits package is availablehere. This position will be posted for a minimum of 5 calendar days. This is a current vacancy, and the employer intends to fill this position within approximately 30 days. Equal Employment Opportunity Statement All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic as protected by applicable law. Job candidates will not be obligated to disclose sealed or expunged records of conviction or arrest as part of the hiring process.
International Information Systems Security Certification Consortium
Position Summary The AI Security Engineer is responsible for identifying, assessing, and mitigating security risks introduced by artificial intelligence and machine learning systems across ISC2's technology estate. This role sits at the intersection of offensive security, application security, and data science - evaluating AI/ML pipelines, large language model (LLM) integrations, and AI-powered products for adversarial threats, model vulnerabilities, and supply chain risks. The AI Security Engineer partners closely with the Security and Technical Operations team, engineering, and product stakeholders to embed security controls throughout the AI development lifecycle and contributes directly to ISC2's ISO/IEC 27001:2022 ISMS program and broader cybersecurity governance objectives. Responsibilities Perform security assessments of AI/ML systems, including threat modeling, adversarial testing, and of LLM-based applications and AI-powered products and services integrated into ISC2's products and operations. Evaluate AI/ML implementations for vulnerabilities including prompt injection, jailbreaking, model inversion, data poisoning, membership inference, and adversarial example attacks. Define and implement secure AI development lifecycle (AI SDLC) standards, including secure model training, data governance, agent, and other access controls, and model deployment guardrails. Conduct third party AI vendor and model supply chain risk assessments; evaluate API based AI services (e.g., OpenAI, Anthropic, Claude Code, Azure OpenAI) for data handling, privacy, and security posture. Partner with engineering and product teams to review AI feature designs, conduct pre deployment security reviews, and provide risk acceptance recommendations for AI related SSDLC exceptions. Monitor the evolving AI threat landscape; maintain awareness of emerging attack techniques, regulatory developments (EU AI Act, NIST AI RMF), and industry best practices (OWASP Top 10 for LLMs, MITRE ATLAS). Support ISC2's ISO/IEC 27001:2022 ISMS by mapping AI risk controls to applicable Annex A requirements (including A.8.25 through A.8.29) and contributing AI specific risk treatment plans to the organizational risk register. Develop and deliver internal training and awareness content on responsible AI use, AI specific threats, and secure integration patterns for developers and business stakeholders. Contribute to ISC2's thought leadership in AI security by supporting content, certification, and research initiatives aligned with the organization's mission. Perform miscellaneous duties as assigned. Behavioral Competencies Intellectual Curiosity: Thrives in an ambiguous, rapidly evolving domain; proactively explores emerging AI capabilities and their security implications. Integrity & Responsibility: Approaches AI security with a strong ethical foundation, particularly around bias, fairness, privacy, and dual use risks of AI systems. Cross Functional Influence: Able to translate complex AI risk concepts for diverse audiences including engineers, executives, auditors, and non technical business stakeholders. Adaptability: Comfortable operating without established playbooks; exercises sound judgment when standards, regulations, and tooling are still maturing. Mission Alignment: Demonstrates genuine commitment to ISC2's mission of supporting a safe and secure cyber world; brings professionalism and advocacy to the AI security discipline. Qualifications Familiarity with AI/ML frameworks (PyTorch, TensorFlow) and cloud based AI services (Azure OpenAI, AWS Bedrock, Google Vertex AI). Working knowledge of AI governance frameworks: NIST AI RMF, OWASP Top 10 for LLM Applications, MITRE ATLAS, and the EU AI Act risk categories. Foundation in traditional application and infrastructure security, including web application testing, network security, and secure coding principles (Python, JavaScript). Relevant certifications preferred: CISSP, CSSLP, GWEB, GMLSC, or emerging AI security certifications; ISC2 certifications are valued. Demonstrated research, publication, conference presentations, or open source contributions in the AI security space are a strong differentiator. Education and Work Experience Bachelor's degree in computer science, Data Science, Cybersecurity, or a related field. Will consider candidates with a high school diploma or regional equivalent, and at least seven (7) years of cybersecurity experience. 3+ years of experience in cybersecurity, with at least 1-2 years focused on AI/ML security, application security, or a closely adjacent field. Experience assessing data privacy risks in AI pipelines, including training data handling, PII exposure, and model output monitoring. Experience with identity and access management in cloud environments, including Okta and SAML/OAuth, is preferred given ISC2's technology stack. Experience supporting ISO/IEC 27001, SOC 2, or similar compliance programs is a plus. Hands on experience with AI/ML security testing techniques, including adversarial ML attacks, LLM prompt injection, RAG pipeline abuse, and tool use exploitation in agentic AI systems. Physical and Mental Demands Ability to travel up to 10% of time, may also include overnight and international travel. Work normal business hours and extended hours when necessary. Remain in a stationary position, often standing or sitting, for prolonged periods. The role requires sustained concentration when analyzing AI model behaviors, reviewing pipeline architectures, and producing detailed technical documentation. Regular use of office equipment such as a computer/laptop and monitor computer screens. Dexterity of hands and fingers to operate a computer keyboard, mouse, and other computer components. Total Rewards The pay range for this position is £50,550 - £67,811 per year. Information regarding our comprehensive benefits package is available here. Equal Employment Opportunity Statement All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic as protected by applicable law. Job candidates will not be obligated to disclose sealed or expunged records of conviction or arrest as part of the hiring process.
Position Summary The AI Security Engineer is responsible for identifying, assessing, and mitigating security risks introduced by artificial intelligence and machine learning systems across ISC2's technology estate. This role sits at the intersection of offensive security, application security, and data science - evaluating AI/ML pipelines, large language model (LLM) integrations, and AI-powered products for adversarial threats, model vulnerabilities, and supply chain risks. The AI Security Engineer partners closely with the Security and Technical Operations team, engineering, and product stakeholders to embed security controls throughout the AI development lifecycle and contributes directly to ISC2's ISO/IEC 27001:2022 ISMS program and broader cybersecurity governance objectives. Responsibilities Perform security assessments of AI/ML systems, including threat modeling, adversarial testing, and of LLM-based applications and AI-powered products and services integrated into ISC2's products and operations. Evaluate AI/ML implementations for vulnerabilities including prompt injection, jailbreaking, model inversion, data poisoning, membership inference, and adversarial example attacks. Define and implement secure AI development lifecycle (AI SDLC) standards, including secure model training, data governance, agent, and other access controls, and model deployment guardrails. Conduct third party AI vendor and model supply chain risk assessments; evaluate API based AI services (e.g., OpenAI, Anthropic, Claude Code, Azure OpenAI) for data handling, privacy, and security posture. Partner with engineering and product teams to review AI feature designs, conduct pre deployment security reviews, and provide risk acceptance recommendations for AI related SSDLC exceptions. Monitor the evolving AI threat landscape; maintain awareness of emerging attack techniques, regulatory developments (EU AI Act, NIST AI RMF), and industry best practices (OWASP Top 10 for LLMs, MITRE ATLAS). Support ISC2's ISO/IEC 27001:2022 ISMS by mapping AI risk controls to applicable Annex A requirements (including A.8.25 through A.8.29) and contributing AI specific risk treatment plans to the organizational risk register. Develop and deliver internal training and awareness content on responsible AI use, AI specific threats, and secure integration patterns for developers and business stakeholders. Contribute to ISC2's thought leadership in AI security by supporting content, certification, and research initiatives aligned with the organization's mission. Perform miscellaneous duties as assigned. Behavioral Competencies Intellectual Curiosity: Thrives in an ambiguous, rapidly evolving domain; proactively explores emerging AI capabilities and their security implications. Integrity & Responsibility: Approaches AI security with a strong ethical foundation, particularly around bias, fairness, privacy, and dual use risks of AI systems. Cross Functional Influence: Able to translate complex AI risk concepts for diverse audiences including engineers, executives, auditors, and non technical business stakeholders. Adaptability: Comfortable operating without established playbooks; exercises sound judgment when standards, regulations, and tooling are still maturing. Mission Alignment: Demonstrates genuine commitment to ISC2's mission of supporting a safe and secure cyber world; brings professionalism and advocacy to the AI security discipline. Qualifications Familiarity with AI/ML frameworks (PyTorch, TensorFlow) and cloud based AI services (Azure OpenAI, AWS Bedrock, Google Vertex AI). Working knowledge of AI governance frameworks: NIST AI RMF, OWASP Top 10 for LLM Applications, MITRE ATLAS, and the EU AI Act risk categories. Foundation in traditional application and infrastructure security, including web application testing, network security, and secure coding principles (Python, JavaScript). Relevant certifications preferred: CISSP, CSSLP, GWEB, GMLSC, or emerging AI security certifications; ISC2 certifications are valued. Demonstrated research, publication, conference presentations, or open source contributions in the AI security space are a strong differentiator. Education and Work Experience Bachelor's degree in computer science, Data Science, Cybersecurity, or a related field. Will consider candidates with a high school diploma or regional equivalent, and at least seven (7) years of cybersecurity experience. 3+ years of experience in cybersecurity, with at least 1-2 years focused on AI/ML security, application security, or a closely adjacent field. Experience assessing data privacy risks in AI pipelines, including training data handling, PII exposure, and model output monitoring. Experience with identity and access management in cloud environments, including Okta and SAML/OAuth, is preferred given ISC2's technology stack. Experience supporting ISO/IEC 27001, SOC 2, or similar compliance programs is a plus. Hands on experience with AI/ML security testing techniques, including adversarial ML attacks, LLM prompt injection, RAG pipeline abuse, and tool use exploitation in agentic AI systems. Physical and Mental Demands Ability to travel up to 10% of time, may also include overnight and international travel. Work normal business hours and extended hours when necessary. Remain in a stationary position, often standing or sitting, for prolonged periods. The role requires sustained concentration when analyzing AI model behaviors, reviewing pipeline architectures, and producing detailed technical documentation. Regular use of office equipment such as a computer/laptop and monitor computer screens. Dexterity of hands and fingers to operate a computer keyboard, mouse, and other computer components. Total Rewards The pay range for this position is £50,550 - £67,811 per year. Information regarding our comprehensive benefits package is available here. Equal Employment Opportunity Statement All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic as protected by applicable law. Job candidates will not be obligated to disclose sealed or expunged records of conviction or arrest as part of the hiring process.