Senior Security Engineer – Offensive Security, Remediation

WeightWatchers

. Run continuous offensive testing against TypeScript applications, APIs, and AWS infrastructure, including new production features .

Posted 11/11/2026full-timeUnited StatesSenior💰 $180,000 - $195,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in offensive security testing, particularly with TypeScript applications and AWS infrastructure. Proficient in identifying and remediating web and API vulnerabilities while managing third-party engagements and utilizing advanced security tools.

Highest-signal resume keywords

Offensive Security TestingTypeScript Application DevelopmentAWS Security ExpertiseOWASP Top 10 Vulnerability AssessmentSAST, DAST, and SCA Tooling

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

TypeScriptNode.jsAWSBurp SuiteOAuth 2.0SASTDASTAPI SecurityPenetration TestingVulnerability Remediation

Soft Skills

Clear Technical Writing

Tools & Technologies

CI/CDNpmReactNext.jsAgent Frameworks

Certifications & Qualifications

AWS Certifications

Industry Keywords

MITRE ATT&CKRed TeamPurple TeamBug Bounty ProgramsCloud Offensive Tooling

Tech Stack

Tools & technologies

AWSCloudJavaScriptKubernetesNext.jsNode.jsPythonReactTypeScript

About the role

Key responsibilities & impact

Run continuous offensive testing against TypeScript applications, APIs, and AWS infrastructure, including new production features
Plan and conduct red team, purple team, and application penetration tests mapped to MITRE ATT&CK
Test web applications and APIs for OWASP Top 10 and API Top 10 vulnerabilities
Test production features under agreed rules of engagement
Attack OIDC/OAuth, SSO, and session-handling controls
Build and operate AI-agent-driven red team workflows with human oversight, scoped targets, kill switches, audit logging, and approval controls
Test AI features and agents for prompt injection, tool misuse, and data leakage
Manage and quality-check third-party penetration testing and red team engagements
Write and ship remediation PRs in TypeScript/Node.js and React/Next.js codebases
Fix vulnerable npm dependencies and build secure-by-default libraries and patterns
Convert findings into regression tests, SAST or lint rules, and CI checks
Emulate AWS and Kubernetes cloud attacks and map application vulnerabilities to cloud impact
Help operate and tune SAST, DAST, and SCA tooling
Triage and validate Bugcrowd submissions and work with engineers on fixes and payouts
Use and improve Claude Security for AI-assisted vulnerability discovery and patching
Report on exploitable findings closed, remediation SLA performance, eliminated bug classes, and tooling signal-to-noise

Requirements

What you’ll need

6+ years in security or software engineering, including 3+ years of hands-on offensive work
Hands-on offensive experience in AWS, including IAM privilege escalation, cross-account and role-trust abuse, SSRF to metadata credentials, and misconfigured public services
Production software engineering experience in TypeScript and Node.js, including fixes shipped through code review, tests, and CI/CD
Deep knowledge of web and API vulnerabilities, including OWASP Top 10 and API Security Top 10
Experience safely testing live production systems under rules of engagement
Working experience with SAST, DAST, and SCA tools, including tuning and triaging output
Hands-on experience using or building agentic workflows for offensive security
Experience with Burp Suite or similar proxies
Scripting custom tooling in TypeScript or Python
Understanding of OAuth 2.0/OIDC, session management, and authorization models
Clear technical writing
React/Next.js and Node.js framework experience, npm supply chain security, custom SAST or ESLint security rules, third-party pentest or red team vendor management, agent frameworks, MCP servers, tool-calling LLM APIs, OWASP Top 10 for LLM Applications, MITRE ATLAS, adversary-emulation tooling, bug bounty programs, cloud offensive tooling, AWS certifications, and regulated-environment experience are nice to have

Benefits

Comp & perks

Comprehensive benefits package
Annual bonus program
Hybrid work environment
Workers' compensation insurance for eligible employees