Senior Offensive Security Engineer

Job Description: - Mature Delinea’s in-house Offensive Security program

• Lead red and purple team operations emulating real-world adversary TTPs
• Test enterprise and product security controls and detection and response capabilities
• Lead internal and external network and infrastructure penetration tests across Azure and AWS environments
• Identify and exploit attack paths in Active Directory, Entra ID, Kerberos, and credential/secrets infrastructure
• Perform source code reviews and execute targeted attacks based on findings
• Create or reproduce proof-of-concept exploits for findings and externally reported vulnerabilities
• Plan and execute penetration testing engagements, including scoping, rules of engagement, testing, documentation, reporting, and remediation validation
• Conduct manual and automated security testing of web applications, APIs, desktop and agent-based clients, and cloud services
• Write penetration test reports with reproduction steps, risk ratings, business impact, and remediation guidance
• Partner with Product Development, DevOps, and IT to explain findings, support root cause analysis, and validate remediation
• Develop custom tools, scripts, and automation to improve testing efficiency and coverage
• Contribute to testing methodologies, playbooks, and environments, including AI model evaluation
• Monitor emerging vulnerabilities, exploitation techniques, and attacker tradecraft
• Communicate technical findings and recommendations to technical and non-technical stakeholders
• Report to the Sr. Manager, Offensive Security

Requirements: - Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent work experience

• Minimum 3+ years of hands-on experience with internal and external web application, API, and network penetration testing
• Experience writing formal penetration test reports documenting test details, vulnerabilities, and risks
• Understanding of penetration testing methodology and frameworks, including MITRE ATT&CK, OWASP, and PTES
• Knowledge of the OWASP Top 10 and OWASP API Security Top 10
• Hands-on experience with Burp Suite, Nmap, Metasploit, BloodHound, and Impacket
• Experience testing Active Directory, Entra ID, Kerberos, OAuth 2.0, OpenID Connect, and SAML
• Proficiency in Python, Go, or PowerShell
• Ability to review C#, Java, or JavaScript/TypeScript source code for security vulnerabilities
• Experience with Azure and AWS cloud infrastructure
• Understanding of the Secure Software Development Lifecycle (SSDLC)
• Ability to demonstrate and explain vulnerabilities to audiences with minimal security expertise
• Ability to manage multiple engagements and meet deadlines with minimal supervision
• Must not require any type of US work authorization now or in the future
• Preferred certifications include ARTE, BSCP, CARTS, CRTL, CRTO, CRTP, eCPPT, eWPT, GPEN, GWAPT, OSCP, OSEP, OSWE, Pentest+, or PNPT
• Preferred experience with command-and-control frameworks, Kubernetes, infrastructure-as-code, CI/CD security, identity and access management, privileged access management, secrets management, AI/LLM security testing, public security research, and FedRAMP or ITAR environments

Benefits: - Equity

• Performance-based bonus plans or role-based incentive programs
• Healthcare insurance
• Pension/retirement matching
• Comprehensive life insurance
• Employee assistance program
• Time off plans
• Paid company holidays
• Meaningful work
• Career progression
• Culture of innovation
• Remote work arrangement