Principal Offensive Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Principal Offensive Security Engineer based in the United States.

As a senior technical leader, you will drive offensive security initiatives designed to strengthen product security and protect enterprise environments. You will lead advanced penetration testing, red-team engagements, and adversary simulation activities across cloud, application, infrastructure, and identity platforms. The role combines hands-on technical execution with strategic leadership, offering opportunities to shape security methodologies and influence organization-wide security improvements. A key focus will be integrating artificial intelligence into offensive security workflows to enhance testing efficiency and effectiveness. Working closely with security operations, engineering, and incident response teams, you will help validate defensive capabilities and reduce organizational risk. This fully remote opportunity is ideal for an experienced security professional passionate about innovation, technical excellence, and mentoring others.

Accountabilities:

• Lead risk-based penetration testing and offensive security assessments across applications, APIs, infrastructure, cloud environments, identity systems, SaaS platforms, and enterprise technologies.
• Plan and execute complex red-team engagements and adversary simulations based on emerging threats, business priorities, and organizational risk.
• Identify and validate security vulnerabilities, assess potential business impact, and demonstrate how weaknesses may contribute to broader security exposure.
• Develop and evaluate AI-assisted workflows and tools to improve offensive security activities, including assessment planning, analysis, automation, and reporting.
• Build and maintain custom scripts, tools, and automation solutions to support authorized security testing and improve operational efficiency.
• Lead security assessments primarily across Google Cloud Platform (GCP) and modern identity environments, with additional coverage of AWS, Azure, and Kubernetes.
• Collaborate with Security Operations, Detection Engineering, Threat Hunting, and Incident Response teams to conduct purple-team exercises and evaluate defensive capabilities.
• Work with engineering and security stakeholders to prioritize remediation, validate corrective actions, and improve detection, monitoring, logging, and incident response processes.
• Prepare comprehensive security reports documenting findings, potential attack paths, business implications, and recommended remediation strategies.
• Communicate technical risks and recommendations effectively to engineering teams, security leadership, and executive stakeholders.
• Define and advance the offensive security roadmap in collaboration with security leadership, establishing scalable methodologies and measurable program objectives.
• Mentor offensive security professionals, provide technical guidance, and promote continuous improvement across the security organization.
• Measure program effectiveness through remediation outcomes, reduced exposure, and improved detection and response capabilities.

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent professional experience.
• At least 8 years of relevant information security experience, including substantial hands-on experience in penetration testing, red teaming, adversary simulation, or offensive security.
• Demonstrated ability to independently lead complex penetration testing engagements and advanced security assessments.
• Strong expertise in at least one major security domain, such as application and API security, cloud security, identity management, or enterprise environments.
• Broad understanding of adversary techniques, security vulnerabilities, privilege management, persistence, lateral movement, and potential data exposure.
• Hands-on offensive security experience with at least one major cloud platform, such as GCP, AWS, or Azure.
• Practical knowledge of modern identity technologies, including Active Directory, SAML, OAuth, OIDC, multi-factor authentication (MFA), and single sign-on (SSO).
• Experience with established offensive security tools, frameworks, and adversary-emulation methodologies.
• Programming and scripting proficiency in Python, PowerShell, Bash, Go, or comparable languages.
• Demonstrated experience integrating artificial intelligence into authorized security testing or red-team operations, including the ability to evaluate results and explain measurable operational benefits.
• Experience planning or leading purple-team exercises and translating security assessment findings into practical defensive improvements.
• Strong knowledge of the MITRE ATT&CK framework and its application to security assessments and defensive coverage.
• Excellent written and verbal communication skills, with the ability to translate complex technical findings into actionable recommendations for diverse audiences.
• Proven leadership, mentoring, collaboration, and project management capabilities.
• Preferred experience building or improving internal offensive security programs and conducting advanced adversary-emulation exercises.
• Familiarity with AI integrations, LLM APIs, agent frameworks, and AI-enabled application security assessments is an advantage.
• Additional expertise in SaaS security, endpoint security, exploit research, social engineering, or Kubernetes security is desirable.
• Relevant professional certifications, such as OSCP, OSEP, OSWE, OSED, CRTO, GXPN, or equivalent credentials, are advantageous.

Benefits:

• Annual salary: $183,000–$200,000, depending on experience, qualifications, certifications, skills, and geographic location.
• Potential eligibility for additional bonus or commission compensation.
• Medical and healthcare benefits.
• Retirement and financial benefits.
• Wellness programs and employee assistance offerings.
• Paid time off and other leave benefits.
• Employee discounts and additional company-sponsored perks.
• Fully remote working arrangement within the United States.
• Opportunities to work with innovative AI technologies and advanced security solutions.
• Professional development opportunities and exposure to complex, high-impact security initiatives.
• Opportunities to influence security strategy, mentor technical professionals, and advance offensive security practices.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!  Why Apply Through Jobgether?    Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.     #LI-CL1