Senior Offensive Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Enhance and develop Delinea’s internal Offensive Security program.

• Oversee red and purple team operations that simulate real-world adversarial tactics, techniques, and procedures (TTPs).

• Assess enterprise and product security controls as well as detection and response capabilities.

• Conduct both internal and external penetration tests on networks and infrastructure within Azure and AWS environments.

• Discover and exploit attack vectors within Active Directory, Entra ID, Kerberos, and credential/secrets infrastructure.

• Execute source code evaluations and carry out targeted attacks based on the results.

• Develop or replicate proof-of-concept exploits for vulnerabilities found and reported externally.

• Organize and carry out penetration testing engagements, including defining scope, establishing rules of engagement, testing, documentation, reporting, and validating remediation.

• Perform both manual and automated security assessments on web applications, APIs, desktop and agent-based clients, and cloud services.

• Author penetration test reports detailing reproduction steps, risk ratings, business impact, and remediation advice.

• Collaborate with Product Development, DevOps, and IT teams to communicate findings, assist in root cause analysis, and confirm remediation efforts.

• Create custom tools, scripts, and automation to enhance testing efficiency and coverage.

• Contribute to the development of testing methodologies, playbooks, and environments, including evaluating AI models.

• Stay informed about emerging vulnerabilities, exploitation techniques, and attacker methodologies.

• Present technical findings and recommendations to both technical and non-technical audiences.

• Report directly to the Sr. Manager of Offensive Security.

⛳️ Requirements

• A Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical discipline, or equivalent professional experience.

• At least 3+ years of practical experience in internal and external web application, API, and network penetration testing.

• Proven experience in drafting formal penetration test reports that detail test specifics, vulnerabilities, and associated risks.

• Familiarity with penetration testing methodologies and frameworks, such as MITRE ATT&CK, OWASP, and PTES.

• Knowledge of the OWASP Top 10 and OWASP API Security Top 10.

• Practical experience with tools like Burp Suite, Nmap, Metasploit, BloodHound, and Impacket.

• Experience in testing Active Directory, Entra ID, Kerberos, OAuth 2.0, OpenID Connect, and SAML.

• Proficiency in programming languages such as Python, Go, or PowerShell.

• Capability to review C#, Java, or JavaScript/TypeScript source code for security vulnerabilities.

• Experience with cloud infrastructures, particularly Azure and AWS.

• Understanding of the Secure Software Development Lifecycle (SSDLC).

• Ability to effectively demonstrate and explain vulnerabilities to audiences with limited security knowledge.

• Competence in managing multiple engagements and meeting deadlines with minimal oversight.

• Must not require any form of US work authorization now or in the future.

• Preferred certifications include ARTE, BSCP, CARTS, CRTL, CRTO, CRTP, eCPPT, eWPT, GPEN, GWAPT, OSCP, OSEP, OSWE, Pentest+, or PNPT.

• Desired experience with command-and-control frameworks, Kubernetes, infrastructure-as-code, CI/CD security, identity and access management, privileged access management, secrets management, AI/LLM security testing, public security research, and FedRAMP or ITAR environments.

🏝️ Benefits

• Equity opportunities.

• Performance-based bonuses or role-specific incentive programs.

• Comprehensive healthcare insurance.

• Pension and retirement matching.

• Extensive life insurance coverage.

• Employee assistance programs.

• Generous time-off policies.

• Paid company holidays.

• Engaging and meaningful work.

• Opportunities for career advancement.

• A culture that fosters innovation.

• Flexibility with remote work arrangements.