Principal Offensive Security Engineer

Role overview Lead hands-on offensive security work across product and enterprise environments, setting technical direction for a risk-focused program. The role combines penetration testing, red-team campaigns, adversary simulations, and practical evaluation of AI-assisted security workflows, with a focus on improving both security controls and the ability to detect and respond to attacks.

Responsibilities - Scope and conduct assessments across applications, APIs, cloud platforms, identity systems, infrastructure, SaaS, and enterprise technology; validate vulnerabilities and realistic attack paths. - Plan and run red-team campaigns and adversary simulations informed by relevant threats and business risk. - Develop and assess AI-assisted workflows for reconnaissance, campaign planning, social engineering, tooling, and analysis. - Build scripts, tools, payloads, and automation; focus cloud and identity testing on GCP while extending work to other major cloud environments and Kubernetes as needed. - Work with detection, operations, incident response, application security, cloud security, IT, and engineering teams on purple-team exercises and improvements to controls, telemetry, and response. - Document technical findings and business impact, recommend and retest fixes, guide the program roadmap, and mentor other practitioners.

Requirements - Bachelor’s degree in a relevant field or equivalent experience. - At least 8 years in information security, including substantial hands-on penetration testing, red teaming, adversary simulation, or offensive security work. - Track record independently leading complex security engagements. - Deep practical expertise in at least one area such as application or API exploitation, cloud security, identity, or enterprise environments; working knowledge of adjacent areas. - Ability to communicate findings and remediation guidance to both technical teams and executives.

Nice to have Experience building an offensive security program; advanced adversary emulation; AI integrations or assessments of AI-enabled systems; GCP, Kubernetes, SaaS, endpoint, exploit development, or social engineering expertise; community contributions; relevant practical security certifications.

Benefits and work setup U.S.-based role. Listed salary range: $183,000–$200,000, with potential additional compensation and benefits. Work involves technology subject to U.S. export controls.