Engineering Manager, Internal Attack

Horizon3.ai

. Lead, coach, and grow a team of Attack Engineers and backend engineers focused on internal network attacks .

Posted 11/5/2026full-timeRemote • United StatesSeniorLead💰 $238,000 - $280,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in offensive security and attack engineering, with a strong focus on Active Directory attacks, team leadership, and performance management. Proven ability to develop strategies for internal network attacks while ensuring operational safety and team growth.

Highest-signal resume keywords

Offensive Security ManagementActive Directory Attack TechniquesTeam Leadership and DevelopmentLinux and Unix Privilege EscalationAutomated Tooling Development

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Active Directory TradecraftKerberos AttacksNTLM Coercion and RelayDatabase ExploitationNetwork Service AttacksPython ProgrammingGit Version ControlNetwork Discovery with NmapLLM-Powered AgentsGraph Database Familiarity

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationJudgment in Ambiguous SituationsTeam BuildingDirect Feedback

Tools & Technologies

SCCMWindows Admin CenterEntra ConnectCI/CD WorkflowsMasscanNucleiNeo4j

Certifications & Qualifications

OSCPOSEPCRTO

Industry Keywords

Offensive SecurityRed TeamAttack EngineeringBreach and Attack SimulationPentesting

Tech Stack

Tools & technologies

LinuxNeo4jPythonUnix

About the role

Key responsibilities & impact

Lead, coach, and grow a team of Attack Engineers and backend engineers focused on internal network attacks
Own hiring for the team, shape open roles, run interview loops, and close offensive and backend engineers
Set expectations by level, provide feedback, run 1:1s and performance reviews, and build growth plans
Develop Staff and Principal technical leaders and distribute domain expertise and review ownership
Own team performance and quality while aligning work with Product and Engineering goals
Define strategy and roadmap for internal and Active Directory attack coverage
Drive coverage for modern hardened environments and evolving internal attack tradecraft
Guide work across credential access, Kerberos and delegation abuse, NTLM coercion and relay, AD Certificate Services, SCCM, ACL and GPO abuse, lateral movement, and Entra ID pivots
Guide coverage across Linux and Unix hosts, databases, network infrastructure, and embedded devices
Own host discovery, service and OS fingerprinting, and credential and secrets discovery at large-network scale
Push the team to build AI agents that improve internal attacks
Own production-safety standards, including account lockout safety, customer exclusions, fragile-device and database handling, artifact cleanup, and safe defaults
Set standards for code review, testing, lab regression testing, and observability
Run execution by scoping roadmap work, balancing new coverage with reliability fixes and customer escalations, and delivering commitments
Partner with Product to prioritize roadmap input from customer feedback, field findings, and threat intelligence
Direct backend work on NodeZero’s attack-path graph and data model and coordinate cross-team changes
Partner with peer Attack Engineering teams on shared infrastructure, cross-domain attack paths, and consistent standards
Own the on-call rotation and serve as escalation point for internal-attack customer issues
Drive triage and root cause analysis, convert recurring issues into durable fixes, and communicate exploitability, impact, and remediation
Support customer briefings, go-to-market enablement, blog posts, and conference talks

Requirements

What you’ll need

2+ years managing engineers on an offensive security, red team, or attack engineering team, including hiring, performance management, and career development
8+ years of combined offensive security and software engineering experience, with significant hands-on time attacking Active Directory and internal enterprise networks
Working command of current AD tradecraft, including Kerberos attacks and delegation, NTLM coercion and relay, AD Certificate Services abuse, ACL and GPO abuse, and lateral movement
Hands-on experience with Linux and Unix privilege escalation and lateral movement, database exploitation, and attacks on network services and devices
Comfortable reading and reviewing production Python and working in Git, merge request, CI/CD, and product development workflows
Experience turning offensive findings or manual techniques into product capabilities, automated tooling, or repeatable services
Sound judgment about operational safety when running offensive techniques against production customer environments
Record of building teams people want to join and stay on, with clear expectations, direct feedback, and engineers who grew under your leadership
Strong written and verbal communication with engineers, product partners, executives, and customers
Comfort setting direction in ambiguous situations without a fully defined roadmap
Experience leading teams that build autonomous pentesting, breach and attack simulation, or other offensive security products
Experience with SCCM, Windows Admin Center, and hybrid identity attacks, including Entra Connect, primary refresh tokens, and seamless SSO
Experience scaling network discovery and scanning with nmap, masscan, or nuclei across very large enterprise networks
Experience building LLM-powered agents or applying AI to offensive security or asset discovery workflows
Familiarity with graph databases such as Neo4j and attack-path analysis
OSCP, OSEP, CRTO, or equivalent offensive certifications
Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs
Experience managing a fully remote engineering team

Benefits

Comp & perks

All full-time roles are eligible for an equity package in the form of stock options
Health, vision & dental insurance for you and your family
Flexible vacation policy
Generous parental leave
Growth opportunities and career development opportunities
Collaborative environment that encourages creativity and out-of-the-box thinking
Remote and hybrid work models depending on role and location