Senior Attack Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct research on OCI attack pathways, identity and trust dynamics, service misconfigurations, and evolving attacker methodologies.

• Design, implement, and validate production-grade Python attack functionalities across OCI IAM, service accounts, workload identities, compute, Kubernetes/OKE, storage, databases, secrets, networking, and various cloud-native services.

• Connect individual vulnerabilities into plausible attack pathways with credible proof of exploitability and clear, actionable outcomes for clients.

• Develop and maintain secure, repeatable attack logic along with supportive testing protocols.

• Analyze failures to enhance reliability, accuracy, and maintainability.

• Collaborate with software engineers, attack engineers, and offensive security subject matter experts to deploy new capabilities into production.

• Implement OCI-based attack pathways as directed by the technical lead and team manager.

• Contribute to the development of NodeZero's next-generation OCI cloud attack capabilities.

⛳️ Requirements

• Practical experience with OCI security and offensive cloud operations.

• Ability to analyze IAM permissions, service identities, trust relationships, and resource access.

• In-depth knowledge of cloud attack pathways and cloud-native security principles.

• Proficiency in Python engineering and experience in transforming security research or manual techniques into reliable production-quality automation or product functionalities.

• Enthusiasm for building products rather than solely identifying vulnerabilities.

• Over 4 years of professional software engineering and/or offensive security experience.

• Experience in cloud penetration testing, red teaming, offensive security research, or developing cloud security solutions.

• Proven track record of collaborating with diverse engineering teams to create products as an individual contributor.

• Preferred: experience with cloud privilege escalation and identity-related attacks.

• Preferred: familiarity with offensive security in AWS, Azure, or GCP.

• Preferred: experience in integrating security research into production software.

• Preferred: experience with OKE, Kubernetes, Terraform, Oracle Cloud APIs, or cloud-native CI/CD.

• Preferred: contributions to security research, open-source initiatives, conference presentations, or vulnerability disclosures.

• Preferred: experience correlating cloud attack coverage with frameworks such as MITRE ATT&CK for Cloud.

🏝️ Benefits

• All full-time positions are eligible for an equity package in the form of stock options.

• Opportunities for career advancement.

• A collaborative and innovative work environment.

• Health, vision, and dental insurance for you and your family.

• Flexible vacation policy.

• Generous parental leave.

• An inclusive culture.

• Remote and hybrid work arrangements based on role and location.