Senior Security Engineer, Offensive Security & Remediation

Accountabilities: Plan and conduct red team, purple team, and application penetration testing activities aligned with the MITRE ATT&CK framework, focusing on relevant threats such as account takeover, API abuse, cloud credential misuse, and data exfiltration. Perform continuous security testing of TypeScript web applications and APIs, identifying vulnerabilities such as broken authorization, IDOR, injection, SSRF, prototype pollution, XSS, and insecure deserialization. Test newly released production features under clearly defined rules of engagement, using dedicated test accounts, rate limits, restricted access, and established stop conditions to protect real user data and system availability. Assess identity and access management systems, including OIDC/OAuth, SSO, session management, and authorization controls. Build and operate AI-driven offensive security workflows, including agents for reconnaissance, attack-path discovery, and continuous testing, with appropriate human oversight, scoped permissions, audit logging, and approval controls. Evaluate internal AI features and agents for prompt injection, unsafe tool usage, and potential data leakage. Manage external penetration testing and red team engagements, from defining scope and rules of engagement to validating findings and coordinating retesting. Develop and deliver remediation pull requests in TypeScript, Node.js, React, and Next.js codebases, following established testing, review, and release processes. Address vulnerable npm dependencies through safe upgrades, lockfile management, and careful handling of breaking changes. Create secure-by-default libraries and reusable engineering patterns for authorization, input validation, output encoding, and secrets management. Convert recurring vulnerability types into lasting safeguards, including regression tests, custom SAST or lint rules, and CI checks. Use AI coding assistants and agents to accelerate remediation while ensuring all changes receive human review. Conduct offensive security assessments of AWS infrastructure, including IAM privilege escalation, role chaining, cross-account trust abuse, exposed credentials, and metadata service exploitation. Assess cloud exposure risks involving public S3 buckets, API Gateway, Lambda, CloudFront, load balancers, internet-facing assets, EKS, and Kubernetes environments. Trace attack paths from application vulnerabilities to potential cloud infrastructure impact and provide platform teams with clear reproduction steps and remediation guidance. Help maintain and improve application security tooling, including SAST, DAST, and SCA, reducing false positives and ensuring genuine vulnerabilities reach the right owners. Triage and validate bug bounty submissions, reproduce reported issues, assess severity, and coordinate fixes and payouts. Improve AI-assisted vulnerability discovery and remediation tooling, validating automated findings and proposed fixes against manual testing. Collaborate with the broader product security team on priorities, findings, and security triage, while reporting on remediation timelines, vulnerabilities resolved, eliminated bug classes, and tooling effectiveness. Requirements: At least 6 years of experience in security or software engineering, including 3 or more years of hands-on offensive security work such as penetration testing, red teaming, purple teaming, or application security testing. Practical offensive security experience in AWS environments, including IAM privilege escalation, cross-account access and role-trust abuse, SSRF-based metadata credential exposure, and misconfigured public services. Production software engineering experience with TypeScript and Node.js, including shipping code fixes through code review, automated testing, and CI/CD pipelines. Deep understanding of web and API security vulnerabilities, particularly the OWASP Top 10 and API Security Top 10, and the ability to implement effective code-level fixes. Experience conducting security testing against live production systems while following defined rules of engagement and operational safeguards. Working knowledge of SAST, DAST, and SCA tools, including configuring, tuning, and triaging their results. Hands-on experience using or developing agentic workflows for offensive security, with a practical understanding of their capabilities, limitations, and risks. Experience with Burp Suite or comparable web security testing proxies, as well as scripting custom security tools using TypeScript or Python. Strong understanding of OAuth 2.0, OIDC, session management, and authorization models. Excellent written communication skills, with the ability to produce actionable vulnerability reports and clear, reliable pull request descriptions. Experience with React/Next.js and Node.js frameworks such as NestJS or Express is an advantage. Familiarity with npm supply chain security, including SBOMs, provenance, lockfile management, and installation-script risks. Experience writing custom SAST rules, such as Semgrep-style rules, or security-focused ESLint rules is a plus. Previous experience managing third-party penetration testing or red team vendors from initial scoping through final retesting is beneficial. Familiarity with agent frameworks, MCP servers, tool-calling LLM APIs, OWASP Top 10 for LLM Applications, or MITRE ATLAS is an advantage. Exposure to adversary-emulation tools such as Atomic Red Team or Caldera, as well as command-and-control frameworks, is a plus. Experience operating or triaging a bug bounty program, working with platforms such as Bugcrowd, maintaining a personal bug bounty track record, or publishing CVEs is beneficial. Knowledge of cloud offensive security tools such as Pacu, CloudFox, or Prowler, and relevant AWS certifications such as AWS Security Specialty, is an advantage. Experience working in regulated environments and familiarity with frameworks or requirements such as HITRUST, SOC 2, and CCPA are desirable. Strong collaboration, analytical thinking, technical judgment, and a proactive approach to identifying and resolving security risks. Benefits: Annual base salary ranging from $180,000 to $195,000 USD. Eligibility for an annual bonus program. Comprehensive employee benefits package. Remote work opportunity within the United States. Opportunity to contribute to a modern, engineering-driven security program with a strong focus on practical security improvements. Exposure to advanced offensive security practices, cloud infrastructure, application security, and AI-assisted security tooling. Opportunity to collaborate with product, platform, and security engineering professionals. Inclusive and collaborative working environment that values diverse perspectives and professional growth.