Senior Attack Engineer, External

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, and sustain highly scalable reconnaissance workflows utilizing production-grade Python.

• Investigate, analyze, and parse vast amounts of external-facing data into precise, actionable insights.

• Create parsing and enrichment processes for unstructured banners, web content, documents, and error outputs.

• Gather, store, and connect large volumes of information.

• Enhance attack-path modeling and graph data models focused on identity, privilege, and relationship pathways.

• Navigate external identity relationships across accounts, tenants, SSO, federation, exposed credentials, and third-party services.

• Automate multi-step attack workflows, covering discovery through credential access, initial access, and post-exploitation.

• Investigate emerging external tradecraft and convert it into production attack content.

• Maintain representative test environments for validating attack scenarios and conducting regression testing.

• Develop production-safe workflows that adhere to target environments, rate limits, and defined scopes.

• Contribute to priorities and coverage roadmaps by leveraging customer environments, threat intelligence, and emerging techniques.

• Mentor colleagues and assist in establishing engineering standards.

• Collaborate with engineers, product managers, and teams that interact with customers.

• Produce internal documentation and external research, including blog posts.

⛳️ Requirements

• Extensive, hands-on offensive experience against external attack surfaces, spanning reconnaissance to initial access and post-exploitation.

• Over 5 years of practical experience in offensive security, security research, and/or security-oriented software engineering.

• Recent track record of building and deploying offensive tooling.

• Experience constructing reconnaissance and discovery systems capable of operating at scale.

• Proficient in researching and parsing large volumes of messy, unstructured external data.

• Experience in collecting, storing, and interlinking vast amounts of data while reasoning about identities, assets, and trust relationships.

• Mastery of identity-focused tradecraft, encompassing credential access, password and token attacks, SSO and federation vulnerabilities, and navigating identities, tenants, and services.

• Experience in automating multi-step attack workflows from start to finish.

• Strong fundamentals in software engineering, particularly with Python.

• Proven history of delivering and maintaining production-quality code.

• Ability to independently investigate unfamiliar systems and technologies.

• Excellent written and verbal communication skills along with technical documentation capabilities.

• A keen interest in product development.

• OSCP, OSEP, CRTO, or similar offensive certifications are a plus.

• Familiarity with certificate transparency, passive DNS, and internet-wide scanning.

• Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, and AWS.

• Proficient in external-to-internal pivoting.

• Experience with graph databases, attack-path analysis, data lakes, and high-volume data processing.

• Involvement in the development or contribution to offensive or reconnaissance tooling.

• Public contributions such as open-source tools, technical blog entries, conference presentations, or published CVEs.

• Experience in building production-safe autonomous or automated offensive tooling.

• Legally authorized to work in the United States.

🏝️ Benefits

• Equity package in the form of stock options available for all full-time positions.

• Comprehensive health, vision & dental insurance for you and your family.

• Flexible vacation policy.

• Generous parental leave.

• Opportunities for career development.

• An inclusive and collaborative workplace culture.

• Options for remote work.