Senior Red Team Operator, Applications

This is a fully remote position, open to applicants in United States.

📋 Description

• Execute comprehensive kill chains on web, mobile, API, and thick/thin client applications.

• Transform identified vulnerabilities into functional exploits with clear documentation while differentiating actual risks from false alarms.

• Analyze the impact of application breaches on identity, cloud, and data security.

• Inspect source code for control-flow vulnerabilities, injection pathways, and insecure design utilizing AI-assisted evaluation.

• Conduct static and dynamic assessments, binary analysis, runtime instrumentation, and API testing.

• Convert tradecraft into actionable techniques, decision-making frameworks, and evaluation metrics for AI agents.

• Stress-test AI swarm attack pathways and pinpoint naive or erroneous behaviors.

• Develop scripts, tools, and plugins to enhance offensive capabilities.

• Create attack reports and conduct debriefs for engineers, executives, and legal teams.

• Investigate new classes of vulnerabilities, exploitation methods, and AI-driven attack strategies.

• Manage concurrent operations and internal research while maintaining a start-up level of independence.

⛳️ Requirements

• Extensive hands-on experience in application offense: web application and API exploitation beyond the OWASP Top 10, including business logic manipulation, authentication and authorization evasion, and injection chains.

• Proficiency in at least one additional attack surface: mobile, thick/thin clients, source code analysis, or reverse engineering.

• Familiarity with tools such as Burp Suite, Caido, ZAP, Frida, jadx, Ghidra, and IDA Pro.

• Strong understanding of network protocols, client-server architecture, and various application vulnerability classes.

• Competency across Linux, Windows, and macOS platforms.

• Ability to script in Bash, Python, or similar languages.

• Experience utilizing AI tools for reconnaissance, analysis, or development purposes.

• Capacity to make timely human-in-the-loop decisions and effectively communicate reasoning to safety and engineering teams.

• Self-motivated, resourceful, and capable of navigating ambiguity.

• Skill in conveying complex attack methodologies to engineers, executives, and legal advisors.

• Must qualify to work in the United States without sponsorship.

• Willingness to travel up to 20% for on-site engagements or client interactions.

• Experience in offensive automation or AI/ML is a plus.

• Background in offensive tooling is a plus.

• Prior achievements in bug bounty programs, CVEs, CTF victories, or application-security conference presentations are advantageous.

• Active participation in PortSwigger Web Security Academy, Hack The Box, or TryHackMe is a plus.

• Relevant certifications such as OSWE, Burp Suite Certified Practitioner, GWAPT, CWES, eWPTX, eMAPT, or TCM Practical Web and Mobile Pentest tracks are advantageous.

🏝️ Benefits

• Comprehensive Health, Dental, & Vision Coverage.

• Significant Equity Ownership.

• In-Office Meals Provided.

• Office Haircuts Available.

• Company Sponsored Conferences & Events.

• 401(k), HSA, and FSA Plans.

• Flexible Paid Time Off (PTO).