Sr Offensive Security Engineer

Accountabilities:

Penetration Testing and Security Assessments: Plan, coordinate, and conduct authorized internal and external security assessments across web and mobile applications, APIs, cloud environments, networks, and infrastructure.
Evaluate application and infrastructure security to identify vulnerabilities, assess potential business impact, and recommend appropriate remediation measures.
Red Team and Purple Team Operations: Design and coordinate authorized red team engagements and adversary simulation exercises to evaluate organizational security resilience.
Collaborate with Security Operations Center (SOC), Threat Intelligence, Threat Hunting, and Detection Engineering teams to assess detection capabilities and strengthen incident response readiness.
Security Research and Vulnerability Assessment: Identify, validate, and assess security weaknesses, including combinations of vulnerabilities that may create significant business risks.
Evaluate findings in controlled and approved environments, documenting their potential impact and providing actionable recommendations.
Adversary Simulation: Apply knowledge of real-world threat actor behaviors and the MITRE ATT&CK framework to assess organizational defenses and improve security monitoring and response capabilities.
Findings Management and Remediation: Review and validate security findings, prioritize vulnerabilities according to exploitability and business risk, and coordinate remediation activities with engineering teams.
Track remediation progress, facilitate follow-up assessments, and ensure agreed security improvements are completed within established service-level agreements.
Security Tooling and Automation: Develop and maintain approved security testing scripts, tools, and automation solutions to improve assessment efficiency and scalability.
Contribute to the implementation and evaluation of continuous security testing and automated security validation platforms.
Reporting and Stakeholder Communication: Prepare comprehensive technical reports and executive-level summaries that translate security findings into understandable business risks and recommendations.
Communicate assessment results to technical teams, Governance, Risk and Compliance (GRC), Audit, and senior leadership.
Incident Response and Threat Hunting Support: Provide offensive security expertise to incident response and threat hunting activities, helping teams understand potential attack scenarios and strengthen defensive strategies.
Continuous Improvement and Mentorship: Develop repeatable security assessment methodologies, operational playbooks, and performance metrics to improve the maturity of the offensive security program.
Mentor junior security engineers and contribute to knowledge sharing, technical development, and continuous improvement across the security organization.
Requirements:
At least 5 years of hands-on professional experience in offensive security, penetration testing, red teaming, or a closely related security engineering discipline.
Demonstrated experience conducting security assessments across multiple technology domains, including web and mobile applications, APIs, networks, infrastructure, and cloud environments.
Strong understanding of vulnerability assessment, ethical hacking principles, security validation, and authorized adversary simulation methodologies.
Experience assessing complex security environments and evaluating how multiple security weaknesses may affect an organization's overall risk exposure.
Familiarity with industry-standard security assessment platforms and tools, such as Burp Suite Professional, Nmap, Metasploit, Kali Linux, and vulnerability scanning solutions.
Proficiency in at least one scripting or programming language, such as Python, Go, PowerShell, Ruby, or Bash, for developing security utilities and automation.
Working knowledge of the MITRE ATT&CK framework and the ability to map security assessments to relevant adversary tactics, techniques, and procedures (TTPs).
Experience with cloud security assessments, particularly within AWS and/or Microsoft Azure environments.
Strong understanding of security operations, vulnerability management, detection engineering, and incident response processes.
Familiarity with non-production and production-representative testing environments, responsible vulnerability validation, and established security testing policies.
Excellent analytical and problem-solving abilities, with the capacity to assess complex technical challenges and communicate practical remediation recommendations.
Strong written and verbal communication skills, including the ability to present technical findings and business risks to both engineering teams and executive stakeholders.
Ability to work independently, manage multiple security initiatives, and collaborate effectively with cross-functional and international teams.
Preferred Qualifications:
Advanced offensive security certifications, such as OSEP, OSCE³, CRTO, or GXPN.
Demonstrated involvement in original security research, responsible vulnerability disclosures, or published CVEs.
Experience assessing cloud-native environments, container technologies, Kubernetes, Amazon EKS, Microsoft AKS, and serverless architectures.
Familiarity with continuous or autonomous penetration testing platforms and breach-and-attack simulation solutions.
Experience with Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms.
Knowledge of detection engineering practices and the ability to contribute to purple team feedback loops and security monitoring improvements.
Familiarity with relevant cybersecurity compliance requirements, industry standards, and security governance frameworks.
Previous experience mentoring junior engineers and contributing to the development and maturity of enterprise offensive security programs.
Benefits:
Full-time employment opportunity with a remote working arrangement based in India.
Competitive employee benefits package, including supplementary healthcare and dental coverage.
Generous paid time off, subject to applicable eligibility requirements.
Employee Assistance Program providing support and resources for employees.
Access to professional development and career advancement opportunities through structured development initiatives.
Participation in the SOAR manager development and leadership program.
Access to mentorship opportunities through dedicated professional development programs.
Employee Impact Groups and employee resource initiatives that encourage inclusion, collaboration, and professional connection.
Paid volunteer opportunities and community engagement initiatives, subject to eligibility requirements.
Inclusive workplace culture built around authenticity, curiosity, integrity, teamwork, and customer focus.
Opportunities to work on enterprise-scale cybersecurity initiatives and collaborate with multidisciplinary security professionals.
A supportive environment that encourages innovation, continuous learning, and meaningful contributions to organizational security.