Senior Offensive Security Engineer

Group 1001

. Plan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, endpoints, internal web and desktop applications, and APIs .

Posted 11/6/2026full-timeRemote • United StatesSenior💰 $200,000 - $270,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in penetration testing, red teaming, and vulnerability management across cloud environments such as Azure, AWS, and GCP. Proven ability to lead security initiatives, mentor teams, and communicate effectively with technical and non-technical stakeholders.

Highest-signal resume keywords

Penetration TestingRed Team OperationsVulnerability TriageBug Bounty Program ManagementCloud Security (Azure, AWS, GCP)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Penetration TestingRed Team OperationsVulnerability TriageRisk PrioritizationContinuous Attack Surface ManagementCustom Tool DevelopmentSecure SDLCDevSecOpsDetection EngineeringAdversary Tactics

Soft Skills

Excellent Communication SkillsTechnical LeadershipCoaching

Tools & Technologies

Cobalt StrikeBurp SuiteCustom C2 FrameworksSIEMEDR

Certifications & Qualifications

OSCPOSWEOSCEGXPN

Industry Keywords

Financial ServicesInsuranceRegulated Environments

Tech Stack

Tools & technologies

AWSAzureGoogle Cloud PlatformPythonRustSDLCC++

About the role

Key responsibilities & impact

Plan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, endpoints, internal web and desktop applications, and APIs
Provide prioritized remediation guidance
Partner with development teams to integrate testing into release and delivery cycles
Help mature application security and SDLC practices
Lead quarterly red team and purple team operations
Manage the private bug bounty program, including strategy, scope, vulnerability triage, severity validation, and remediation coordination
Operate the continuous attack surface monitoring platform and drive remediation of external findings
Oversee third-party testing vendors and the annual external penetration test
Validate remediation through retesting and track findings to closure
Translate offensive findings into defensive improvements with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit
Develop and refine offensive tooling, techniques, and processes
Track and report program metrics, risk reduction, and security posture improvements
Present results to technical teams and senior leadership
Provide technical leadership, coaching, and work direction to additional offensive security team members as the team grows

Requirements

What you’ll need

8+ years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles
Experience performing penetration tests against Azure, AWS, and/or GCP environments, endpoints, web and desktop/native applications, and APIs
Experience conducting full-scope red team operations and purple team exercises
Strong background in vulnerability triage, risk prioritization, and guiding remediation
Experience managing or significantly contributing to a bug bounty program
Familiarity with continuous attack surface management platforms and external exposure reduction
Understanding of adversary tactics, techniques, and procedures (TTPs) and modern detection and response capabilities
Excellent written and verbal communication skills, including presenting findings and risk to executives and non-technical stakeholders
Preferred: experience developing custom tooling, exploits, implants, payloads, or evasion techniques
Preferred: hands-on experience with Cobalt Strike, custom C2 frameworks, Burp Suite, and modifying offensive tools
Preferred: programming or scripting proficiency in Python, PowerShell, C/C++, Rust, etc.
Preferred: certifications such as OSCP, OSWE, OSCE, GXPN, or equivalent demonstrated expertise
Preferred: experience with third-party penetration testing vendors
Preferred: experience with secure SDLC, DevSecOps, or secure code review
Preferred: knowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives
Preferred: prior experience in financial services, insurance, or regulated environments
Preferred: prior experience mentoring or leading other security engineers

Benefits

Comp & perks

Bonus
Health insurance
Dental insurance
Vision insurance
Basic and Supplemental Life Insurance
Short- and Long-Term Disability
Employee Assistance Program
Wellness programs
401K plan with matching contributions