Offensive Security Engineer

Shape our offensive security services

Ready to immerse yourself in the world of securing critical IT by thinking and acting like a real adversary? Join our security team at Schuberg Philis! We are an engineering company with a people-centric approach and a focus on customer satisfaction, dedicated to delivering mission critical IT solutions to our customers.

As an offensive security specialist, you will collaborate with about 30 customer-oriented teams managing critical system environments. Your role is pivotal in ensuring the security of Schuberg Philis and its customers by identifying and exploiting realistic paths in our complex, one-of-a-kind environments. You will scope, execute, and report on penetration tests, purple and red teaming engagements, and threat modeling assessments tailored to our unique and complex mission-critical environments. We focus on what real-world adversaries search for and abuse, not compliance-driven checks that look good on paper but don't raise resilience.

You will engage closely with engineers, customer teams, external experts, vendors, and stakeholders to define and drive work that measurably strengthens these environments. The engagements are hands-on and technical, and we want someone who can own an engagement end-to-end: from a customer saying "we want to test something, can you help us figure out what?" all the way to presenting the results of a bespoke engagement to their board.

At Schuberg Philis, we thrive on growth and innovation, offering an exciting environment for security enthusiasts. We are actively seeking security professionals at various seniority levels to join our security team. We provide a challenging and rewarding atmosphere where autonomy in your day-to-day operations is valued.

We are a small team and we are part of the team that works on our value propositions for security. This means we have a lot of mandate to define and shape offensive security services within Schuberg Philis.

In this role, you will work with cutting-edge technologies, spanning private and public clouds and VMs to serverless - all highly automated. As an offensive security specialist your skills will be put to the test in a diverse technological landscape.

Success in this role requires a unique blend of skills and traits

• 7+ years of experience (the more the better) in an offensive security role.
• A security mindset aimed at identifying realistic attack paths from a real-world adversaries' perspective.
• Giving security advice that fits the unique and challenging mission-critical environments we manage to help our teams set up strong defense-in-depth. Recommendations should fit the environment in front of you, not a textbook fix that can't be applied there.
• You will have the experience and judgment to run engagements on your own, and the collaborative instinct to tackle the hardest problems together. Our teams will love you if you can take them by the hand through the entire process.
• Experience and understanding at least one of the major clouds (AWS, Azure, GCP).
• Strong risk management thinking, sense of ownership, and a solid BS radar.
• Eagerness to learn, coupled with a stubborn determination to make things happen.
• Experience with building solid tools that support our activities.
• Experience in IT engineering and IT engineering heavy environments preferred.

What will be your focus?

• Help scope, lead, execute, and report on various types of complex offensive security engagements. Every environment is unique, and we expect our engagements to treat them as such as well.
• Build and maintain tools to help scale our offensive security services well beyond a small team. As an example: by building and maintaining a secure AI penetration testing methodology and toolkit that can be used by our customer teams.
• Collaborating with all customer teams, offering guidance on security-related topics.
• Evaluating and improving the security resilience of Schuberg Philis itself through red and purple teaming engagements.
• Using your technical and soft skills to guide the organization in adopting security measures along with the broader security team. We show impact, and can help limit it.

Where we would love to grow as a team
We care more about mindset, experience, and being calm under pressure than a checklist of specific technologies. Our best work comes from people who can rely on experience and the right mindset to tackle the unfamiliar. However, if you bring depth in advanced malware development, Kubernetes, or OT security, you'll find eager sparring partners and plenty of room to make those areas your own.