Security Penetration Tester
About Xerox Holdings Corporation
For more than 100 years, Xerox has continually redefined the workplace experience. Harnessing our leadership position in office and production print technology, we’ve expanded into software and services to sustainably power the hybrid workplace of today and tomorrow. Today, Xerox is continuing its legacy of innovation to deliver client-centric and digitally-driven technology solutions and meet the needs of today’s global, distributed workforce. From the office to industrial environments, our differentiated business and technology offerings and financial services are essential workplace technology solutions that drive success for our clients. At Xerox, we make work, work. Learn more about us at www.xerox.com.
About the Role
XCS (Xerox) is seeking a Penetration Tester with approximately 3 years of hands-on experience to join our Offensive Security team. In this role, you will identify, exploit, and help remediate security vulnerabilities across our applications, networks, and infrastructure through simulated attacks, contributing directly to the security posture of our products and enterprise environment.
Key Responsibilities
- Plan and execute penetration tests against web applications, networks, APIs, and cloud environments to identify exploitable vulnerabilities.
- Perform manual and automated security testing using industry-standard tools (e.g., Burp Suite, Metasploit, Nmap, Nessus, Cobalt Strike).
- Document findings clearly in professional reports, including risk ratings, reproduction steps, and remediation recommendations.
- Collaborate with engineering and IT teams to validate fixes and re-test remediated issues.
- Stay current on emerging threats, attack techniques, and vulnerability disclosures relevant to Xerox's technology stack.
- Support red team exercises, social engineering assessments, or physical security tests as needed.
- Contribute to internal tooling, scripts, or playbooks that improve testing efficiency and coverage.
- Assist with compliance-driven testing (e.g., PCI-DSS, SOC 2) as required.
Required Qualifications
- Approximately 3 years of professional experience in penetration testing, offensive security, or a closely related role.
- Must be based in the United States and authorized to work in the U.S. without sponsorship.
- Solid understanding of common vulnerability classes (OWASP Top 10, network-layer attacks, privilege escalation, etc.).
- Hands-on experience with penetration testing tools and frameworks (Burp Suite, Metasploit, Nmap, Kali Linux, etc.).
- Working knowledge of scripting/programming (Python, Bash, or PowerShell) for tooling and automation.
- Strong written communication skills for producing clear, actionable technical reports.
- Ability to work independently in a remote environment while collaborating across distributed teams.
Preferred Qualifications
- Industry certifications such as OSCP, CEH, or GPEN (preferred, not required).
- Experience testing cloud environments (AWS, Azure, or GCP).
- Familiarity with secure code review or application security testing.
- Prior experience in a regulated industry (e.g., government, healthcare, finance, or print/imaging technology).