Principal Offensive Security Engineer

Job Description: - Lead risk-prioritized penetration testing and offensive security assessments across products, web applications, APIs, infrastructure, cloud, identity, SaaS, and enterprise technologies

• Identify, validate, and safely exploit vulnerabilities and demonstrate realistic attack paths
• Scope, design, and execute red-team campaigns and adversary simulations based on relevant threats, emerging techniques, and business risk
• Develop and evaluate AI-assisted workflows for reconnaissance, campaign development, social engineering, tooling, and analysis
• Develop custom scripts, tooling, payloads, and automation for offensive security engagements
• Conduct offensive security and red-team assessments primarily across GCP and modern identity platforms, with AWS, Azure, and Kubernetes as relevant
• Plan and execute purple-team exercises with SOC, Detection Engineering, Threat Hunting, and Incident Response teams
• Validate telemetry, detections, investigation workflows, response capabilities, logging, monitoring, playbooks, and defensive controls
• Partner with engineering and defensive teams to prioritize remediation, retest fixes, and verify improvements
• Document findings, attack paths, business impact, and recommended remediation for technical and executive audiences
• Own technical direction and execution of the offensive security roadmap
• Mature testing methodologies and mentor offensive security practitioners through hands-on pairing
• Measure program effectiveness through verified remediation, reduced exposure to critical attack paths, and repeatable validation of detection and response coverage

Requirements: - Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent experience

• 8+ years of relevant information security experience, including significant hands-on experience in penetration testing, red teaming, adversary simulation, or offensive security
• Experience independently leading complex penetration tests or offensive security engagements
• Deep hands-on expertise in application/API exploitation, cloud offensive security, identity, or enterprise environments
• Practical working knowledge across offensive security domains and ability to chain weaknesses into realistic attack paths and assess business impact
• Strong knowledge of attacker techniques across initial access, credential access, privilege escalation, persistence, lateral movement, defense evasion, and data access
• Hands-on offensive security experience in at least one major cloud platform (GCP, AWS, or Azure) and modern identity environments
• Experience with Active Directory, SAML, OAuth, OIDC, MFA, and SSO
• Experience with modern offensive security tooling and frameworks across web, identity, network, and adversary-emulation testing
• Ability to develop or modify offensive security tooling using Python, PowerShell, Bash, Go, or similar
• Hands-on experience incorporating AI into offensive security or red-team operations, with concrete examples of workflows or tools developed or adapted, validation, and operational benefits
• Experience planning or leading purple-team exercises and translating offensive findings into defensive improvements
• Strong understanding of MITRE ATT&CK and ability to map offensive activity to adversary techniques and defensive coverage
• Excellent written and verbal communication skills, including communicating technical risk to engineering teams, security leadership, and executives
• Experience mentoring offensive security engineers, setting technical direction, and influencing outcomes across engineering and security teams
• Ability to serve in compliance with U.S. export controls
• Preferred: contributions to the offensive security or AI security community
• Preferred: experience building or maturing an internal red-team or offensive security program
• Preferred: advanced adversary-emulation or assumed-breach exercises
• Preferred: AI integrations using agent frameworks, LLM APIs, or local or hosted models
• Preferred: assessing AI-enabled applications, LLM-integrated systems, or agentic workflows
• Preferred: SaaS security, endpoint/EDR evasion, exploit development, or social engineering
• Preferred: repeatable purple-team validation programs
• Preferred: strong hands-on offensive security experience in GCP and Kubernetes assessment
• Preferred: OSCP, OSEP, OSWE, OSED, CRTO, GXPN, or comparable certifications

Benefits: - Bonus or commission eligibility

• Medical benefits
• Retirement benefits
• Financial benefits
• Wellness benefits
• Paid time off
• Employee discounts
• Diverse, equitable, and inclusive workplace
• Growth mindset support through all career stages