Senior Offensive Security Engineer

This is a fully remote position, open to applicants in California, +1 more state.

📋 Description

• Strategize and execute objective-driven red team operations targeting cloud, corporate, and production environments.

• Conduct purple team exercises alongside Security Operations to evaluate and enhance detection and response capabilities.

• Perform comprehensive security assessments of Unity products and services, which include web applications, APIs, the engine, editor, client runtime, advertising and monetization systems, as well as developer-facing platforms.

• Identify and illustrate attack vectors across multi-cloud environments, Kubernetes and containers, CI/CD pipelines, as well as identity and secrets management.

• Assess LLM integrations, AI-native products, and agent workflows for vulnerabilities such as prompt injection, data leakage, tool misuse, and excessive permissions.

• Document clear and prioritized findings with realistic impacts; collaborate with relevant teams on remediation efforts and retesting of solutions.

• Develop and sustain tools, scripts, and automation processes that enhance adversarial engineering and convert recurring findings into continuous monitoring checks.

• Create risk-based testing plans, execute red team or adversary emulation operations, deliver executive-ready reports, and monitor remediation progress.

• Work in conjunction with Product Security, Infrastructure Security, Security Operations, and engineering teams.

⛳️ Requirements

• Over 6 years of experience in offensive security (red teaming, penetration testing, purple teaming, or vulnerability research), including the ability to lead engagements from start to finish.

• Practical experience in attacking cloud environments (GCP, AWS, or Azure), focusing on identity, Kubernetes and containers, and CI/CD pipelines.

• Proficient in web application and API security testing, capable of identifying logic flaws beyond mere scanner results.

• Strong scripting or programming skills in languages such as Python, Go, or C/C++ for tool and exploit development.

• Experience in executing adversary emulation or red team operations against realistic objectives and collaborating with defenders during purple team exercises.

• Excellent written and verbal communication skills; ability to articulate technical risks to both engineers and non-technical leadership.

• Capability to work collaboratively within a team, sharing ideas, providing support, and celebrating successes together.

• Proficient in English for effective professional verbal and written communication.

• Preferred: Experience testing LLM-based products, AI agents, or AI-assisted developer tools.

• Preferred: Skills in reverse engineering, binary exploitation, or security measures related to game clients and anti-cheat mechanisms.

• Preferred: Background in gaming, ad tech, or extensive developer-facing platforms.

• Preferred: Involvement in bug bounty programs, CVEs, conference presentations, published research, or contributions to open-source security tools.

• Relevant certifications like OSCP, OSEP, OSWE, or CRTO are beneficial but will not replace a proven track record.

🏝️ Benefits

• Comprehensive health, life, and disability insurance

• Commute subsidy

• Employee stock ownership

• Competitive retirement/pension plans

• Generous vacation and personal days

• Support for new parents through leave and family-care programs

• Office food snacks

• Mental Health and Wellbeing programs and support

• Employee Resource Groups

• Global Employee Assistance Program

• Training and development programs

• Volunteering and donation matching program

• Equity awards

• Participation in company incentive plans, including annual discretionary bonuses or sales commissions