Senior Offensive Security Engineer
$196,750–$243,290 year
On-siteSan Mateo, California, United States
Job Summary
Conduct full-stack security assessments across web applications, APIs, cloud infrastructure, and backend systems. Collaborate with detection engineers through purple team exercises, breach attack simulations, and threat emulation to validate detection coverage. Develop custom security testing tools, BAS frameworks, and automation scripts for repeatable testing and quantifiable improvements. Design metrics-driven frameworks to measure security control effectiveness and detection coverage over time. Research evolving attack techniques and methodologies to contribute to both offensive and defensive security improvements. Share knowledge across security teams to foster a culture of continuous security improvement.
Required Qualifications
- 4+ years of relevant professional experience in offensive security
- demonstrated experience in purple team exercises
- demonstrated experience in breach attack simulation
- demonstrated experience in detection engineering collaboration
- proficiency in Python or Go for building security tooling and automation
- experience with SOAR platforms
- experience with configuration management
- performing full-stack security assessments of web applications
- performing full-stack security assessments of APIs
- performing full-stack security assessments of cloud infrastructure
- performing full-stack security assessments of backend systems
- implementing and managing breach attack simulation platforms
- working with detection engineering teams to validate and improve detection coverage
- Deep understanding of OWASP Top 10 vulnerabilities
- knowledge of common attack techniques
- knowledge of exploit development
- knowledge of post-exploitation methodologies
- knowledge of security assessment frameworks (MITRE ATT&CK, PTES)
- knowledge of BAS methodologies
- knowledge of modern detection stack components (EDR, SIEM, XDR)
- knowledge of security concepts including reverse engineering
- knowledge of cloud security (AWS/Azure/GCP)
- knowledge of container security
- knowledge of CI/CD pipeline security
- knowledge of API security
- knowledge of security metrics development
- Certifications: such as OSCP, OSCE, GXPN, or equivalent practical experience
- strong analytical and problem-solving abilities
- excellent technical writing for detailed reports
- ability to clearly communicate complex technical concepts
- self-motivated with a passion for offensive security and detection engineering
- Roles that are based at our headquarters in San Mateo, CA
- onsite Tuesday, Wednesday, and Thursday
- optional presence on Monday and Friday
Desired Qualifications
- Collaborative: You thrive working with your direct team and cross-functional partners, especially in bridging the gap between offensive operations and detection engineering
- Thoughtful of build vs. buy decisions: Comfortable with deploying and configuring Open Source software, but you also review what tools are available in the market to make informed decisions about tool selection and development
- Comfortable with ambiguity: You can gather data and make informed decisions when there is no clear answer, especially when dealing with novel attack scenarios or detection challenges
- Security-minded educator: You excel at translating complex technical findings into actionable insights for various stakeholders across the organization
- Metrics-driven: You understand the importance of measuring security improvements and can develop frameworks to quantify the effectiveness of security controls and detection capabilities
- Improvement-oriented: You actively seek opportunities to enhance both offensive capabilities and detection coverage, always thinking about the bigger security picture
- Adaptable: You stay current with evolving threats and defense mechanisms, adjusting your approach as the security landscape changes
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.