Senior Security Engineer, Offensive Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Plan and carry out internal penetration testing independently across applications, APIs, cloud infrastructure, and corporate systems.

• Assess risks and business impact to prioritize evaluations.

• Collaborate with system owners to define the scope of testing and rules of engagement.

• Evaluate production risks and validate vulnerabilities in a secure manner.

• Integrate hands-on testing with source code reviews and architectural assessments.

• Work alongside engineering teams to address findings, facilitate remediation, and perform retesting.

• Stay informed about Liftoff’s systems and the associated attack surface.

• Transform confirmed findings into repeatable testing processes.

• Develop testing tools and workflows to enable automated testing and validation of remediation.

• Enable self-service security testing through reusable tests and well-documented workflows.

• Assist in annual third-party penetration testing and ensure follow-through on remediation of findings.

• Champion the use of AI-assisted offensive security tools for code analysis, test generation, and triaging findings.

• Collaborate with Detection & Response teams to enhance detection capabilities and participate in incident-response exercises.

• Support security priorities related to applications, cloud services, and infrastructure, including Accelerate and MX.

• Engage in on-call duties and incident-response rotations, including occasional responses outside regular hours and post-incident follow-ups.

⛳️ Requirements

• Over 5 years of relevant experience in security engineering, including significant hands-on penetration testing of applications and infrastructure.

• Exceptional judgment in prioritizing testing based on risk, evaluating production impact, and safely validating exploits.

• Proven ability to independently manage assessments through to remediation and retesting.

• Proficiency in writing production-quality code for security tools and automation.

• Capability to review pull requests and navigate extensive, unfamiliar codebases.

• Skill in developing safe proof-of-concept code and independently validating AI-generated code and findings.

• Strong grasp of application and API security, authentication and authorization, network security, and common vulnerability types.

• Practical experience in assessing cloud and infrastructure security, including identity and access controls, configurations, and attack vectors.

• Ability to comprehend complex systems and architecture, contributing across application, cloud, and infrastructure security.

• Strong software engineering practices, including testing, observability, version control, peer code reviews, continuous integration, and conducting blameless postmortems.

• Excellent technical writing skills for creating assessment plans, proposals, reproducible findings, runbooks, and post-incident reviews.

• Willingness to share on-call and incident-response duties, including occasional off-hours responses.

• Familiarity with Go, Python, Clojure, or JavaScript is a plus.

• Experience in developing AI-assisted security testing workflows is advantageous.

• Background in securing large-scale cloud systems, mobile advertising, or high-volume SaaS environments is preferred.

🏝️ Benefits

• Bonus

• Equity

• Medical coverage

• Wellness stipends

• Additional perks based on country of residence

• Fast-paced, collaborative, and innovative work environment

• Opportunities for employee growth and impact