Lead Engineer Offensive Security

Job Summary

Responsibilities

1. Security Assessments

• Stand up and scale the product security assessment function from zero, including the intake, scoping, and triage model that decides which products get assessed and at what depth.
• Lead threat-led assessments of new, existing, and acquired products, reasoning about trust boundaries, authorization models, and data flows to find design flaws dynamic testing misses. On high-risk launches, run them early enough to change designs, not ship dates.
• Reduce our dependency on third-party testing engagements for low and moderate-risk applications.
• Automate the repeatable parts: data collection, threat model generation, control validation, and finding triage, so human judgment goes to the flaws that need it. 

2. Penetration Testing 

• Plan, scope, and execute hands-on penetration tests across applications (web, API, mobile), IoT and embedded devices, multi-tenant SaaS, product cloud environments, and AI systems (LLMs, agents, ML pipelines).
• Produce prioritized, reproducible findings with remediation guidance engineers act on, and set the methodology, rules of engagement, and quality bar for the function. 

3. Product Red Team 

• Design and execute objective-based red team operations against product environments, using emulation plans grounded in telecom threat intelligence, in partnership with detection and response.
• Conduct adversarial testing of AI systems: prompt injection, model evasion, data poisoning, model extraction, agent and tool abuse, and AI supply chain attacks. 

4. Offensive AI Engineering 

• Build and operate an AI-driven offensive capability, orchestrating commercial and open-source agents to cut time-to-test and cost-to-test, including continuous autonomous testing of high-value applications against a defined quality bar.
• Build internal tooling and automation across the lifecycle, from recon through reporting and remediation tracking, that turns one-off engagements into durable capability. 

5. Program and Partnership 

• Partner across the security organization to feed findings into threat models and secure-by-default guardrails, define the metrics that show whether this function is working, and set technical direction for the engineers who join it. 

Qualifications

• 10+ years in security engineering, including 5+ years hands-on offensive security across penetration testing, red teaming, assessment, or vulnerability research, or equivalent demonstrated capability. Technical degree or equivalent experience.
• Experience as a founding or first-in-discipline hire, building an offensive security or red team function from zero, including methodology and tooling that outlast your own engagements.
• Demonstrated self-direction: scoping your own work, managing your own pipeline, delivering without close supervision, and setting technical direction for other engineers.
• AI-native working style, with fluent daily use of LLMs and coding agents and concrete examples of how they multiplied your output as a tester.
• Deep, hands-on expertise testing modern web applications, APIs, and mobile, including authentication, authorization, session management, and business logic flaws.
• Experience testing IoT and embedded devices (firmware, UART, JTAG/SWD, SPI/I2C), multi-tenant SaaS (tenant isolation, OAuth/SAML), and container and CI/CD pipeline attacks.
• Working knowledge of applied cryptography, key management, and common cryptographic failure modes.
• Proven ability to lead threat modeling and architecture review, decomposing systems into trust boundaries, authorization models, and data flows to find design-level flaws. 
• Experience building or scaling an assessment program: standardizing methodology, defending risk-based prioritization to leadership, and shifting coverage in-house without reducing assurance. 
• Hands-on experience planning and executing objective-based red team operations under formal rules of engagement, working with detection and response to translate tradecraft into coverage. 
• Hands-on adversarial testing of AI/ML systems (prompt injection, jailbreaks, model evasion, supply chain and agent abuse) aligned to OWASP LLM Top 10 and MITRE ATLAS, with a realistic view of what autonomous offensive platforms can do today. 
• Ability to build offensive tooling, not just consume commercial scanners. Comfortable writing exploits, harnesses, and pipelines in Python, Go, and one of C/C++, TypeScript, or Rust. 
• Excellent written and verbal communication: findings engineers act on, and briefings that land with technical and non-technical leadership. Builds trust with engineering by partnering on fixes. 

Preferred Qualifications

• Operating autonomous penetration testing platforms in production, or building agentic offensive tooling for recon, exploitation, or triage. 
• Original vulnerability research, CVEs, public exploits, contributions to offensive open-source tooling, or a bug bounty track record. 
• Telecom or service provider experience testing DOCSIS, PON, Wi-Fi, mobile, or video product ecosystems. 
• Active or previously held US government security clearance, or experience in restricted or trusted-access environments (cleared programs, export-controlled work, CALEA-adjacent systems). 
• Conference talks, papers, or training (DEF CON, Black Hat, USENIX Security, OffensiveCon), or certifications such as OSCP, OSEP, OSEE, or GIAC GXPN.