Lead Analyst - Penetration Tester 

The Big Picture 

Sysco LABS is the Global In-House Center of Sysco Corporation (NYSE: SYY), the world’s largest foodservice company. Sysco ranks 56th in the Fortune 500 list and is the global leader in the trillion-dollar foodservice industry.   

Sysco employs over 75,000 associates, has 337 smart distribution facilities worldwide and over 14,000 IoT-enabled trucks serving 730,000 customer locations. For fiscal year 2025 that ended June 29, 2025, the company generated sales of more than $81.4 billion. Sysco LABS Sri Lanka delivers the technology that powers Sysco’s end-to-end operations.   

Sysco LABS’ enterprise technology is present in the end-to-end foodservice journey, enabling the sourcing of food products, merchandising, storage and warehouse operations, order placement and pricing algorithms, the delivery of food and supplies to Sysco’s global network and the in-restaurant dining experience of the end-customer.   

The Opportunity 

The Lead Analyst - Penetration Tester is a key role within Sysco’s Corporate Cybersecurity organization, responsible for leading offensive security testing across web applications, APIs, cloud platforms (Azure, AWS, GCP), and internal enterprise environments. 

This is a senior individual contributor role suited for an experienced penetration tester who enjoys deep manual testing, uncovering complex attack paths, and partnering closely with Application Security, Cloud Security, Vulnerability Management, and Threat Hunting teams. The role includes planned evening or weekend testing for production environments, balanced with compensatory time off to maintain a sustainable work schedule. 

Responsibilities: 

• Leading penetration testing of web and API applications, including JavaScript-heavy applications, WordPress, and Apache-backed services, using Veracode, Burp Suite, and advanced manual testing techniques 

• Conducting penetration testing and security assessments of cloud platforms (Azure, AWS, GCP) and internal infrastructure, including Active Directory, Azure AD, and identity systems 

• Assessing modern technologies such as AI/ML and LLM-backed components to identify misuse, data exposure, and abuse scenarios 

• Producing clear, structured penetration testing reports, communicate risk and remediation priorities, and supporting secure SDLC activities including design and code reviews 

• Manually retesting vulnerabilities to validate remediation and collaborating with threat hunters and detection engineers to validate detections based on real-world attack paths 

• Planning and scoping penetration testing engagements, including effort estimation and coordination of off-hours testing windows in alignment with change and maintenance schedules 

• Maintaining and improving penetration testing standards, tools, checklists, and playbooks across application, cloud, identity, and AI testing domains 

• Providing technical mentoring and guidance to junior and mid-level penetration testers 

Requirements: 

• A Bachelor’s Degree in Cybersecurity, Computer Science, or a related field 

• 5+ years of hands-on penetration testing or offensive security experience, including leading complex engagements 

• Strong expertise in web and API penetration testing, including authentication/authorization flaws, business logic issues, IDOR, SSRF, and injection vulnerabilities 

• Experience performing cloud security assessments across Azure, AWS, and GCP, identifying misconfigurations and privilege escalation paths 

• Hands-on experience assessing Active Directory and Azure AD environments using tools such as BloodHound 

• Must possess the ability to develop scripts, proof-of-concept exploits, and small tools using languages such as Python, PowerShell, or Bash 

• Strong written and verbal communication skills, with the ability to clearly present findings to technical and non-technical stakeholders 

Preferred Qualifications: 

• A Master’s Degree in Cybersecurity, Computer Science, or a related field 

• 7+ years of offensive security or penetration testing experience 

• Certifications such as OSCP, GPEN, GXPN, CEH, eCPPT, eWAPT, CPENT or equivalent 

• Familiarity with secure SDLC practices and contributing to security standards and playbooks 

• Experience testing AI/ML-enabled systems and identifying AI-specific abuse cases 

Work Mode & Environment 

• Work Mode: Hybrid 

• Planned participation in evening or weekend testing windows, with compensatory weekdays off 

• Minimal travel required 

• Office-type remote work environment as part of a globally distributed security team 

Benefits:   

• US dollar-linked compensation    

• Performance-based annual bonus    

• Performance rewards and recognition    

• Agile Benefits - special allowances for Health, Wellness & Academic purposes    

• Paid birthday leave   

• Team engagement allowance    

• Comprehensive Health & Life Insurance Cover - extendable to parents and in-laws    

• Overseas travel opportunities and exposure to client environments    

• Hybrid work arrangement    

Sysco LABS is an Equal Opportunity Employer.