Staff Attack Engineer, External

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, construct, and sustain highly scalable reconnaissance workflows using production-grade Python.

• Investigate, analyze, and convert extensive amounts of external-facing data into precise, actionable insights.

• Create parsing and enrichment solutions for free-form banners, web content, documents, and error outputs.

• Gather, store, and interconnect vast quantities of data.

• Expand attack-path modeling and graph data models pertaining to identity, privilege, and relationship pathways.

• Navigate identity relationships across accounts, tenants, SSO, and federation, as well as exposed credentials and third-party services.

• Automate complex multi-step attack workflows from discovery and credential access to initial access and post-exploitation.

• Investigate emerging external tradecraft and transform it into actionable production attack content.

• Maintain representative testing environments for validating and regression-testing attack scenarios.

• Develop for production safety and scalability while considering target environments, rate limits, and scope.

• Establish priorities and coverage roadmaps utilizing customer environments, threat intelligence, and new techniques.

• Mentor and enhance the skills of attack engineers.

• Collaborate with engineers, product managers, and teams interfacing with customers.

• Create internal documentation as well as external research and blog content.

⛳️ Requirements

• Extensive, hands-on offensive experience targeting external attack surfaces, from reconnaissance to initial access and post-exploitation.

• Over 10 years of practical experience in offensive security, security research, or security-oriented software engineering.

• Recent involvement in the development and deployment of offensive tooling.

• Experience in creating reconnaissance and discovery systems capable of operating at scale.

• Strong ability to research and parse large quantities of disorganized, unstructured external data.

• Proficient in collecting, storing, and interconnecting high volumes of data while analyzing relationships such as identities, assets, and trust.

• Mastery of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation vulnerabilities, and movement across identities, tenants, and services.

• Proven experience in automating multi-step attack workflows from start to finish.

• Strong software engineering foundations with Python and a history of delivering and maintaining production-quality code.

• Ability to independently research unfamiliar systems and technologies.

• Excellent written and verbal communication skills, including the ability to produce clear technical documentation.

• A passion for product development, not merely identifying vulnerabilities.

• OSCP, OSEP, CRTO, or an equivalent offensive certification is a plus.

• Familiarity with certificate transparency, passive DNS, and internet-wide scanning is advantageous.

• Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, AWS, and transitions from on-premises to cloud, is beneficial.

• Background in external-to-internal pivoting is advantageous.

• Experience with graph databases, attack-path analysis, data lakes, and high-volume data storage and processing is a plus.

• Participation in the development or contribution to offensive or reconnaissance tooling is advantageous.

• Public contributions such as open-source tools, technical blog posts, conference presentations, or published CVEs are valued.

• Experience in building production-safe autonomous or automated offensive tools is an advantage.

• Legally authorized to work in the United States.

🏝️ Benefits

• Equity package in the form of stock options for all full-time positions.

• Health, vision, and dental insurance coverage for you and your family.

• Flexible vacation policy.

• Generous parental leave.

• Opportunities for career development.

• A collaborative and innovative work environment.

• Fully remote work arrangement.

• Up to 5% travel.