Staff Engineer - Offensive Security

Overview

Staff Offensive Security Engineer (Technical Lead) responsible for designing and executing advanced offensive security testing and reporting.

What you'll do

• Perform manual and automated penetration testing of web applications, APIs, and mobile apps (iOS/Android).
• Conduct network and cloud-level assessments using various tooling.
• Validate and triage vulnerabilities from automated scanners or bug bounty reports to eliminate false positives and escalate true positives.
• Run prompt injection and jailbreak tests on AI prototypes, services, and applications.
• Draft high-quality technical reports with reproducible “path to compromise” steps.
• Manage and update the team’s testing infrastructure (e.g., Burp Suite and C2 listeners).

What you'll need

• 7-10 years of experience in offensive security, penetration testing, bug bounty, AppSec, or vulnerability exploitation.
• Track record of finding high/critical vulnerabilities in complex environments using pentesting commercial or custom tools.
• Expert knowledge of the MITRE ATT&CK matrix and OWASP Top 10 for web applications and top 10 for LLMs, including post-exploitation and Adversarial ML.
• Proficiency with OffSec tools such as Burp Suite Professional, Nmap, Metasploit, and Wireshark.
• Ability to write functional scripts in Python or Bash and proficiency in coding/scripting like Python, C++, and creating custom offensive exploits.
• Advanced industry certifications such as OSCP, OSEP, OSWE, GXPN or similar (highly desirable).

Details

• Work mode: remote, with occasional in-person travel for team or project meetings.
• Remote eligibility exclusions: not eligible for CA, CT, NJ, NY, PA, WA.