Senior Offensive Security Engineer

Role overview

Help mature an internal offensive security program by testing products and enterprise systems against realistic attacker techniques. This senior hands-on role spans red and purple team exercises, infrastructure and application penetration testing, exploit development, and remediation support, working with engineering and operations teams to strengthen defenses. The position is fully remote in the United States.

Responsibilities - Develop red and purple team operations that exercise security controls and detection and response capabilities. - Plan and conduct internal and external penetration tests across network, infrastructure, cloud, and product environments, including Azure and AWS. - Investigate identity attack paths involving directory services, authentication protocols, credentials, and exposed secrets. - Review source code and use findings to guide targeted testing; reproduce or build proof-of-concept exploits where appropriate. - Test web applications, APIs, desktop clients, agents, and cloud services, with attention to authentication, authorization, sessions, and privileged access. - Document scope, methods, evidence, risk, business impact, and actionable remediation; partner with teams to validate fixes. - Build scripts and tools, improve testing playbooks, and share knowledge about emerging vulnerabilities and attacker techniques.

Requirements - At least three years of hands-on experience in internal and external penetration testing; the source also calls for a relevant technical degree or equivalent work experience. - Practical ability to assess infrastructure, cloud environments, applications, APIs, and identity systems. - Experience planning testing engagements through scoping, rules of engagement, execution, reporting, and remediation validation. - Strong technical writing, analytical problem-solving, and ability to explain findings to technical and non-technical stakeholders. - Ability to work collaboratively with product development, DevOps, IT, and security operations while balancing risk and business needs.

Nice to have

Experience testing AI or LLM-based systems, including prompt injection and the OWASP Top 10 for LLM Applications; public security research, bug bounty, CVE, or CTF experience; and work in regulated environments such as FedRAMP or ITAR.

Benefits and work setup

The role is US-based and remote. Benefits include healthcare, retirement matching, life insurance, an employee assistance program, paid time off, company holidays, and a bonus program.