Senior Engineer, Offensive Security
$117,600–$161,700 year
On-siteChicago, Illinois, United States or New York City, New York, United States
Job Summary
Build agentic offensive tooling using production Python and LLM-driven planning loops to accelerate penetration tests, purple-team exercises, and red-team operations. Execute network, web-application, and cloud testing with your own judgment, then validate security countermeasures with defensive partners to close gaps. Run adversarial assessments of internal AI systems, including prompt injection, jailbreaks, and model extraction, while operating within acceptable-use policies. Ship software with engineering rigor and deliver findings with reproduction steps and business impact. Work with considerable autonomy alongside the AI & Offensive Tooling Lead to stand up repeatable adversarial testing for enterprise AI products.
Required Qualifications
- Offensive operations experience: 4+ years in roles such as Red Team, Penetration Testing, Purple Team / control validation, or Bug Bounty, with a track record of delivering engagements end to end: scoping, execution, and clear written findings
- Production Python engineering: you build and operate real tooling, not only one-off scripts
- You've built with agentic AI: hands-on designing, building, or operating AI agents or LLM applications: agentic workflows, tool/function-calling, and orchestration
- You've attacked AI: hands-on testing of AI/ML systems: prompt injection, jailbreaking, and adversarial techniques
- Cloud fluency: production experience with at least one major Cloud Service Provider (AWS, GCP, or Azure)
- Selected candidate must reside within approximately 60 minutes driving distance from one of the following locations: ((Louisville KY, NYC Metro, Dallas Metro, Charlotte NC Metro, South Florida(Tampa/Miami/Ft Lauderdale) , Washington DC metro, Chicago, Boston, Atlanta, Nashville))
- At minimum, a download speed of 25 Mbps and an upload speed of 10 Mbps is required
- Work from a dedicated space lacking ongoing interruptions to protect member PHI / HIPAA information
Desired Qualifications
- Built autonomous or semi-autonomous offensive agents, LLM-driven penetration-testing agents, or reinforcement-learning exploit and attack-path planners
- Red-team tradecraft: C2 frameworks (e.g. Cobalt Strike, Sliver, Mythic), evasion and OPSEC, and testing endpoints protected by modern EDR/XDR
- Purple-team and adversary-emulation fluency: MITRE ATT&CK, and platforms such as VECTR or Atomic Red Team
- Hands-on with AI red-teaming frameworks such as PyRIT or Garak, and fluent in MITRE ATLAS, the OWASP Top 10 for LLM Applications, and the NIST AI Risk Management Framework
- Model Context Protocol (MCP), building clients/servers, or testing them and RAG pipelines for tool/prompt-injection abuse
- Cloud penetration-testing depth or multi-cloud breadth; threat-intelligence-driven operations; depth in an advanced offensive specialty (malware development, advanced red-team operations, or adversarial ML research)
- Published research, open-source contributions, or talks at DEF CON (incl. the AI Village / Generative Red Team), BSides, x33fcon, or Black Hat, or strong showings in AI-security competitions like HackAPrompt
- Certifications are a plus, not a gate, offensive (e.g. OSCP, OSEP, OSED, OSCE3, CRTO, CRTL, CPTS, CWES, CWEE, CAPE) and emerging AI-security (e.g. the OffSec AI Red Teamer (OSAI / AI-300), the SANS/GIAC AI security line, the HTB AI Red Teamer path)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.