Staff Engineer, Offensive Security

What you'll do

• Perform manual and automated penetration testing on web applications, APIs, and mobile apps.
• Conduct network and cloud infrastructure audits focusing on IAM misconfigurations and container escapes.
• Triage and validate vulnerability reports from automated scanners and bug bounty programs.
• Execute prompt injection and jailbreak tests on AI models and services using OWASP standards.
• Develop custom payloads, droppers, and scripts to bypass EDR/AV systems for stealthy operations.
• Design and lead multi-week Red Team operations to emulate specific threat actors.
• Provide technical guidance to engineering teams to remediate vulnerabilities like XSS, SQLi, and IDOR.
• Build automated testing frameworks to identify sensitive data leakage in AI systems.

What we're looking for

• Experience of 7-10 years in offensive security, penetration testing, AppSec, or vulnerability exploitation.
• Expert knowledge of MITRE ATT&CK, OWASP Top 10 for web applications, and OWASP Top 10 for LLMs.
• Proficiency with tools including Burp Suite, Nmap, Metasploit, Wireshark, and C2 frameworks like Cobalt Strike or Sliver.
• Ability to write functional scripts in Python or Bash to automate testing and create custom offensive exploits.
• Experience with AI security tools such as LangChain, TensorFlow for adversarial testing, or other LLM evaluation frameworks.
• Possession of advanced industry certifications such as OSCP, OSEP, OSWE, GXPN, or similar OffSec training is highly desirable.
• Expertise in cloud infrastructure attacks (AWS/Azure/K8s) and identifying IAM misconfigurations or container escapes.
• Telecom expertise is preferred.