Senior Offensive Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Plan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, as well as endpoints, internal web and desktop applications, and APIs.

• Deliver prioritized remediation recommendations.

• Collaborate with development teams to incorporate testing into release and delivery workflows.

• Enhance application security and Software Development Life Cycle (SDLC) practices.

• Lead quarterly red team and purple team initiatives.

• Oversee the private bug bounty program, focusing on strategy, scope, vulnerability triage, severity assessment, and remediation coordination.

• Manage the continuous attack surface monitoring platform and facilitate the remediation of external findings.

• Supervise third-party testing vendors and coordinate the annual external penetration test.

• Verify remediation through retesting and track findings to closure.

• Convert offensive findings into defensive enhancements in collaboration with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit teams.

• Develop and refine offensive tools, techniques, and workflows.

• Monitor and report on program metrics, risk reduction, and improvements in security posture.

• Present findings to technical teams and senior leadership.

• Offer technical leadership, coaching, and work direction to additional offensive security team members as the team expands.

⛳️ Requirements

• 8+ years of practical experience in penetration testing, red teaming, or similar offensive security roles.

• Proficient in conducting penetration tests on Azure, AWS, and/or GCP environments, endpoints, web and desktop/native applications, and APIs.

• Experience in executing full-scope red team operations and purple team exercises.

• Strong foundation in vulnerability triage, risk prioritization, and remediation guidance.

• Experience in managing or significantly contributing to a bug bounty program.

• Familiarity with continuous attack surface management platforms and strategies for reducing external exposure.

• Understanding of adversary tactics, techniques, and procedures (TTPs) alongside modern detection and response capabilities.

• Exceptional written and verbal communication skills, including the ability to present findings and risks to executives and non-technical stakeholders.

• Preferred: experience in developing custom tools, exploits, implants, payloads, or evasion techniques.

• Preferred: hands-on experience with Cobalt Strike, custom C2 frameworks, Burp Suite, and modifying offensive tools.

• Preferred: programming or scripting proficiency in Python, PowerShell, C/C++, Rust, etc.

• Preferred: certifications such as OSCP, OSWE, OSCE, GXPN, or equivalent demonstrated expertise.

• Preferred: experience with third-party penetration testing vendors.

• Preferred: experience with secure SDLC, DevSecOps, or secure code review practices.

• Preferred: knowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives.

• Preferred: previous experience in financial services, insurance, or regulated environments.

• Preferred: experience mentoring or leading other security engineers.

🏝️ Benefits

• Bonus

• Health insurance

• Dental insurance

• Vision insurance

• Basic and Supplemental Life Insurance

• Short- and Long-Term Disability

• Employee Assistance Program

• Wellness programs

• 401K plan with matching contributions