Senior Attack Engineer, GCP

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct research on GCP attack vectors, identity and trust relationships, service misconfigurations, and the latest attacker techniques.

• Design, implement, and validate production-grade Python attack capabilities across GCP IAM, service accounts, workload identities, compute resources, Kubernetes/GKE, storage solutions, databases, secrets management, networking, and various cloud-native services.

• Integrate individual vulnerabilities into plausible attack paths, providing reliable proof of exploitability and actionable outcomes for customers.

• Establish the technical direction for GCP attack coverage and collaborate with Product and Engineering to prioritize tasks.

• Transform research findings and customer requirements into a structured roadmap.

• Develop and sustain secure, repeatable attack logic along with supporting tests.

• Analyze failures to enhance reliability, accuracy, and maintainability.

• Work closely with software engineers, attack engineers, and offensive security subject matter experts to deploy capabilities into production.

• Document research results, attack strategies, and technical design decisions.

• Review designs and code, share expertise in the domain, and mentor fellow engineers.

• Contribute to internal enablement and, when applicable, external research or technical resources.

⛳️ Requirements

• Extensive hands-on experience with GCP security and offensive cloud operations.

• Proficient in reasoning about IAM permissions, service identities, trust, and access to resources.

• In-depth understanding of cloud attack vectors and cloud-native security principles.

• Advanced Python programming skills.

• Proven experience in converting security research or manual techniques into reliable production-quality automation or product functionalities.

• Over 10 years of professional experience in software engineering and/or offensive security.

• Background in cloud penetration testing, red teaming, offensive security research, or the development of cloud security products.

• Track record of managing ambiguous technical tasks, making informed trade-offs, and communicating effectively with both technical and non-technical stakeholders.

• Strong written communication and documentation abilities.

• Experience with cloud privilege escalation and identity-based attacks.

• Familiarity with offensive security in AWS, Azure, or OCI.

• Experience integrating security research into production software environments.

• Experience with GKE, Kubernetes, Terraform, gcloud, Google Cloud APIs, or cloud-native CI/CD practices.

• Contributions to security research, open-source projects, conference presentations, or vulnerability disclosures.

• Experience aligning cloud attack coverage with frameworks such as MITRE ATT&CK for Cloud.

• Legal authorization to work in the United States.

🏝️ Benefits

• Equity package in the form of stock options for all full-time positions.

• Health, vision, and dental insurance coverage for you and your family.

• Flexible vacation policy.

• Generous parental leave.

• Opportunities for career development.

• An inclusive and collaborative work culture.

• Fully remote work setup.

• Up to 10% travel.