Engineering Manager, Internal Attack

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead, mentor, and develop a team of Attack Engineers and backend engineers focused on internal network threats.

• Take ownership of the hiring process for the team, define open positions, conduct interview loops, and successfully recruit offensive and backend engineers.

• Establish expectations for each level, provide constructive feedback, conduct one-on-ones and performance evaluations, and create growth plans.

• Cultivate Staff and Principal technical leaders, sharing domain expertise and ownership of reviews.

• Manage team performance and quality while ensuring alignment with Product and Engineering objectives.

• Develop strategies and a roadmap for internal and Active Directory attack coverage.

• Enhance coverage for modern hardened environments and adapt to evolving internal attack methodologies.

• Oversee efforts in credential access, Kerberos and delegation abuse, NTLM coercion and relay, AD Certificate Services, SCCM, ACL and GPO abuse, lateral movement, and Entra ID pivots.

• Guide coverage efforts across Linux and Unix hosts, databases, network infrastructure, and embedded devices.

• Ensure host discovery, service and OS fingerprinting, and credential and secrets discovery are effective at a large-network scale.

• Encourage the team to develop AI agents that enhance internal attacks.

• Maintain production-safety standards, including account lockout safety, customer exclusions, fragile-device and database handling, artifact cleanup, and safe defaults.

• Establish standards for code review, testing, lab regression testing, and observability.

• Manage execution by defining roadmap tasks, balancing new coverage with reliability fixes and customer escalations, and fulfilling commitments.

• Collaborate with Product to prioritize input for the roadmap based on customer feedback, field findings, and threat intelligence.

• Direct backend initiatives on NodeZero’s attack-path graph and data model and coordinate cross-team modifications.

• Work closely with peer Attack Engineering teams on shared infrastructure, cross-domain attack paths, and consistent standards.

• Oversee the on-call rotation and act as the escalation point for internal-attack customer issues.

• Drive triage and root cause analysis, convert recurring issues into sustainable fixes, and communicate exploitability, impact, and remediation strategies.

• Assist in customer briefings, go-to-market enablement, blog posts, and conference presentations.

⛳️ Requirements

• 2+ years of experience managing engineers in an offensive security, red team, or attack engineering environment, including hiring, performance management, and career development.

• 8+ years of combined experience in offensive security and software engineering, with substantial hands-on experience in attacking Active Directory and internal enterprise networks.

• Proficient understanding of current Active Directory techniques, including Kerberos attacks and delegation, NTLM coercion and relay, AD Certificate Services abuse, ACL and GPO abuse, and lateral movement.

• Practical experience with Linux and Unix privilege escalation and lateral movement, database exploitation, and attacks on network services and devices.

• Comfortable reviewing and working with production Python code, as well as using Git, merge requests, CI/CD, and product development workflows.

• Proven ability to transform offensive findings or manual techniques into product features, automated tools, or repeatable services.

• Strong judgment regarding operational safety when executing offensive techniques in production customer environments.

• A track record of building teams that individuals aspire to join and remain with, characterized by clear expectations, direct feedback, and engineers who have thrived under your leadership.

• Excellent written and verbal communication skills with engineers, product partners, executives, and customers.

• Comfortable establishing direction in uncertain situations without a fully defined roadmap.

• Experience leading teams that develop autonomous pentesting, breach, and attack simulation, or other offensive security products.

• Familiarity with SCCM, Windows Admin Center, and hybrid identity attacks, including Entra Connect, primary refresh tokens, and seamless SSO.

• Experience scaling network discovery and scanning using nmap, masscan, or nuclei across extensive enterprise networks.

• Experience creating LLM-powered agents or applying AI to offensive security or asset discovery processes.

• Knowledge of graph databases such as Neo4j and attack-path analysis.

• Possession of OSCP, OSEP, CRTO, or equivalent offensive certifications.

• Public contributions, such as open-source tools, technical blog posts, conference presentations, or published CVEs.

• Experience managing a fully remote engineering team.

🏝️ Benefits

• All full-time positions are eligible for an equity package in the form of stock options.

• Health, vision, and dental insurance coverage for you and your family.

• Flexible vacation policy.

• Generous parental leave.

• Opportunities for growth and career development.

• A collaborative environment that fosters creativity and innovative thinking.

• Remote and hybrid work models available depending on the role and location.