Senior Security Engineer, Offensive Security & Remediation

Role overview Strengthen product security through continuous offensive testing of web applications, APIs, identity systems, and cloud infrastructure, then turn findings into lasting fixes. The work is weighted toward hands-on red and purple team activity, with roughly a third focused on remediation, secure engineering patterns, and guardrails. Testing includes newly released features and AI-enabled workflows, under defined controls and human oversight.

Responsibilities - Plan and conduct red team, purple team, and application penetration tests, mapping activity to MITRE ATT&CK and prioritizing account compromise, API abuse, cloud credential misuse, and data exposure risks. - Probe TypeScript applications and APIs for common web and API weaknesses, and assess identity flows such as OAuth/OIDC, SSO, and session management. - Test production features under agreed rules, using dedicated accounts, rate limits, and stop conditions that protect real user data. - Build and operate AI-assisted offensive testing workflows for reconnaissance and attack path discovery, with scoped targets, audit logs, kill switches, and approval for high-impact actions; assess AI features for prompt injection, unsafe tool use, and data leakage. - Implement fixes in TypeScript, Node.js, React, or Next.js code, and create reusable secure patterns and regression controls such as tests, lint rules, or CI checks. - Improve security testing tools and processes, including SAST, DAST, dependency analysis, bug bounty, and third-party testing engagements from scoping through retesting.

Requirements - Senior-level security engineering experience spanning offensive testing and practical remediation in software codebases. - Strong knowledge of web application and API security risks, including authorization flaws, injection, SSRF, XSS, and insecure deserialization. - Ability to write and review TypeScript/Node.js and React/Next.js changes, including safe dependency upgrades and tests. - Experience with identity security, cloud security, and structured penetration testing or red team engagements. - Familiarity with security testing tools and methods such as SAST, DAST, software composition analysis, and bug bounty programs. - Sound judgment for testing live systems safely, with documented scope, human review, and protections against access to real member data.

Nice to have - Experience testing AWS environments, including IAM privilege escalation and role chaining. - Experience building AI-assisted security workflows or evaluating AI agents.