Principal Offensive Security Engineer

Accountabilities:

Lead risk-based penetration testing and offensive security assessments across applications, APIs, infrastructure, cloud environments, identity systems, SaaS platforms, and enterprise technologies.
Plan and execute complex red-team engagements and adversary simulations based on emerging threats, business priorities, and organizational risk.
Identify and validate security vulnerabilities, assess potential business impact, and demonstrate how weaknesses may contribute to broader security exposure.
Develop and evaluate AI-assisted workflows and tools to improve offensive security activities, including assessment planning, analysis, automation, and reporting.
Build and maintain custom scripts, tools, and automation solutions to support authorized security testing and improve operational efficiency.
Lead security assessments primarily across Google Cloud Platform (GCP) and modern identity environments, with additional coverage of AWS, Azure, and Kubernetes.
Collaborate with Security Operations, Detection Engineering, Threat Hunting, and Incident Response teams to conduct purple-team exercises and evaluate defensive capabilities.
Work with engineering and security stakeholders to prioritize remediation, validate corrective actions, and improve detection, monitoring, logging, and incident response processes.
Prepare comprehensive security reports documenting findings, potential attack paths, business implications, and recommended remediation strategies.
Communicate technical risks and recommendations effectively to engineering teams, security leadership, and executive stakeholders.
Define and advance the offensive security roadmap in collaboration with security leadership, establishing scalable methodologies and measurable program objectives.
Mentor offensive security professionals, provide technical guidance, and promote continuous improvement across the security organization.
Measure program effectiveness through remediation outcomes, reduced exposure, and improved detection and response capabilities.
Requirements:
Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent professional experience.
At least 8 years of relevant information security experience, including substantial hands-on experience in penetration testing, red teaming, adversary simulation, or offensive security.
Demonstrated ability to independently lead complex penetration testing engagements and advanced security assessments.
Strong expertise in at least one major security domain, such as application and API security, cloud security, identity management, or enterprise environments.
Broad understanding of adversary techniques, security vulnerabilities, privilege management, persistence, lateral movement, and potential data exposure.
Hands-on offensive security experience with at least one major cloud platform, such as GCP, AWS, or Azure.
Practical knowledge of modern identity technologies, including Active Directory, SAML, OAuth, OIDC, multi-factor authentication (MFA), and single sign-on (SSO).
Experience with established offensive security tools, frameworks, and adversary-emulation methodologies.
Programming and scripting proficiency in Python, PowerShell, Bash, Go, or comparable languages.
Demonstrated experience integrating artificial intelligence into authorized security testing or red-team operations, including the ability to evaluate results and explain measurable operational benefits.
Experience planning or leading purple-team exercises and translating security assessment findings into practical defensive improvements.
Strong knowledge of the MITRE ATT&CK framework and its application to security assessments and defensive coverage.
Excellent written and verbal communication skills, with the ability to translate complex technical findings into actionable recommendations for diverse audiences.
Proven leadership, mentoring, collaboration, and project management capabilities.
Preferred experience building or improving internal offensive security programs and conducting advanced adversary-emulation exercises.
Familiarity with AI integrations, LLM APIs, agent frameworks, and AI-enabled application security assessments is an advantage.
Additional expertise in SaaS security, endpoint security, exploit research, social engineering, or Kubernetes security is desirable.
Relevant professional certifications, such as OSCP, OSEP, OSWE, OSED, CRTO, GXPN, or equivalent credentials, are advantageous.
Benefits:
Annual salary: $183,000–$200,000, depending on experience, qualifications, certifications, skills, and geographic location.
Potential eligibility for additional bonus or commission compensation.
Medical and healthcare benefits.
Retirement and financial benefits.
Wellness programs and employee assistance offerings.
Paid time off and other leave benefits.
Employee discounts and additional company-sponsored perks.
Fully remote working arrangement within the United States.
Opportunities to work with innovative AI technologies and advanced security solutions.
Professional development opportunities and exposure to complex, high-impact security initiatives.
Opportunities to influence security strategy, mentor technical professionals, and advance offensive security practices.