Test Engineer Principal (Security)
General Dynamics Information Technology19 hours ago
Albany, NY, USAStaff+
Base Salary
$98k - $132k/yr
Responsibilities
- Select, evaluate, configure, validate, and maintain security testing tools and document tool-selection rationale.
- Review application and architecture changes to determine security test scope and develop comprehensive test plans and cases.
- Perform manual and automated application security testing covering authentication, authorization, input handling, injection, session management, data protection, access-control bypass, business-logic abuse, and data exposure.
- Review source code and infrastructure-as-code for security defects and collaborate with engineers on reproduction, disposition, remediation, and fixes.
- Integrate SAST, DAST, SCA, and secrets scanning into GitLab CI pipelines and tune rules for useful results.
- Develop and execute AWS security tests covering IAM, VPC segmentation, exposed services, encryption, login, privilege escalation, containers, serverless systems, and managed services.
- Validate AWS Security Hub and Config outputs, test Bedrock and API Gateway deployments, and conduct adversary-emulation exercises.
- Triage findings, track remediation to closure, perform retesting, report security-posture trends, and integrate results into the vulnerability-management lifecycle.
- Prepare periodic reports and write clear findings with reproducible steps, impact, severity, and remediation guidance.
- Influence secure engineering practices through architecture guidance, reference implementations, mentorship, and communication with technical and non-technical stakeholders.
Requirements
- Bachelor’s degree in computer science, information security, or a related field, or equivalent experience.
- At least 8 years of information security experience, including at least 5 years of hands-on application testing or offensive security work.
- Demonstrated depth in web application and API testing.
- Experience testing systems under FedRAMP, HIPAA, or other regulated frameworks.
- Working knowledge of NIST 800-53 control families and evidence mapping.
- Proficiency in Python or a similar scripting language for tooling and automation.
- Experience with Burp Suite Pro, OWASP ZAP, Nmap, Metasploit, Nessus or Qualys, sqlmap, Prowler, ScoutSuite, Pacu, and CloudSploit.
- Experience running security tooling in GitLab CI or an equivalent CI/CD environment.
- Experience converting requirements and risks into actionable test cases and acceptance criteria.
- Healthcare payer, Medicaid, or public-sector program experience.
- Ability to obtain and maintain required New York State background checks.
- Strong technical writing, communication, individual-contributor, architecture-guidance, and mentorship skills.
- Preferred certifications include OSCP, OSWE, GPEN, GWAPT, GCPN, or AWS Security Specialty.
- Preferred experience includes hands-on AWS security testing, mainframe-adjacent systems, LLM-based application testing, Java or COBOL code review, purple-team work, detection engineering, SIEM, and cloud-native logging.
Benefits
- Comprehensive medical, dental, vision, wellness, disability, life, accident, critical illness, and business-travel insurance options.
- 401(k) plan with company match and pre-tax and post-tax contribution options.
- Paid vacation, sick, personal, holiday, parental, military, bereavement, and jury-duty leave.
- Full-flex work week and flexible work-life balance options.
- AI-powered career development tool and internal mobility support.
- Hybrid work if local to Albany, New York, or 100% remote work otherwise.
- Regular schedule of 40 hours per week with no travel required.
About General Dynamics Information Technology
General Dynamics Information Technology (GDIT) delivers enterprise IT, systems integration, cybersecurity, cloud, and software engineering services to U.S. federal agencies, including defense and intelligence organizations. It provides contract-based professional and managed services ranging from network operations and unified communications to training and simulation. GDIT is a business unit of General Dynamics (NYSE: GD) and is headquartered in Falls Church, Virginia.