Senior Offensive Security Engineer

Job Description: - Plan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, endpoints, internal web and desktop applications, and APIs

• Provide prioritized remediation guidance
• Partner with development teams to integrate testing into release and delivery cycles
• Help mature application security and SDLC practices
• Lead quarterly red team and purple team operations
• Manage the private bug bounty program, including strategy, scope, vulnerability triage, severity validation, and remediation coordination
• Operate the continuous attack surface monitoring platform and drive remediation of external findings
• Oversee third-party testing vendors and the annual external penetration test
• Validate remediation through retesting and track findings to closure
• Translate offensive findings into defensive improvements with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit
• Develop and refine offensive tooling, techniques, and processes
• Track and report program metrics, risk reduction, and security posture improvements
• Present results to technical teams and senior leadership
• Provide technical leadership, coaching, and work direction to additional offensive security team members as the team grows

Requirements: - 8+ years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles

• Experience performing penetration tests against Azure, AWS, and/or GCP environments, endpoints, web and desktop/native applications, and APIs
• Experience conducting full-scope red team operations and purple team exercises
• Strong background in vulnerability triage, risk prioritization, and guiding remediation
• Experience managing or significantly contributing to a bug bounty program
• Familiarity with continuous attack surface management platforms and external exposure reduction
• Understanding of adversary tactics, techniques, and procedures (TTPs) and modern detection and response capabilities
• Excellent written and verbal communication skills, including presenting findings and risk to executives and non-technical stakeholders
• Preferred: experience developing custom tooling, exploits, implants, payloads, or evasion techniques
• Preferred: hands-on experience with Cobalt Strike, custom C2 frameworks, Burp Suite, and modifying offensive tools
• Preferred: programming or scripting proficiency in Python, PowerShell, C/C++, Rust, etc.
• Preferred: certifications such as OSCP, OSWE, OSCE, GXPN, or equivalent demonstrated expertise
• Preferred: experience with third-party penetration testing vendors
• Preferred: experience with secure SDLC, DevSecOps, or secure code review
• Preferred: knowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives
• Preferred: prior experience in financial services, insurance, or regulated environments
• Preferred: prior experience mentoring or leading other security engineers

Benefits: - Bonus

• Health insurance
• Dental insurance
• Vision insurance
• Basic and Supplemental Life Insurance
• Short- and Long-Term Disability
• Employee Assistance Program
• Wellness programs
• 401K plan with matching contributions