[Remote] Staff Offensive Security Engineer

Note: The job is a remote job and is open to candidates in USA. Eden Prescott is partnering with a FinTech client to hire a Staff Offensive Security Engineer for its Red Team. The role leads hands-on red team exercises and penetration testing across web and mobile applications, APIs, cloud infrastructure, identity systems, and corporate environments. The engineer will identify and communicate security risks, support remediation and incident response, develop offensive tooling, shape red team strategy, and mentor other engineers.

Responsibilities

• Plan and execute sophisticated red team exercises that simulate realistic adversary behavior and attack paths
• Conduct advanced penetration testing and offensive security assessments across web applications, mobile applications (iOS/Android), APIs, cloud infrastructure, identity systems, and corporate environments
• Identify and exploit vulnerabilities across modern application architectures and demonstrate realistic business impact
• Test authentication, authorization, session management, access controls, APIs, and other critical application security boundaries
• Conduct adversarial simulations alongside detection, incident response, and security engineering teams
• Evaluate and bypass defensive technologies including EDR, AV, IDS/IPS, and other detection controls
• Develop scripts, tooling, and automation to improve offensive security capabilities and testing efficiency
• Perform threat modeling against new technologies, architectures, and business processes
• Partner directly with engineering teams to understand vulnerabilities, prioritize risk, and drive effective remediation
• Communicate offensive security findings clearly to audiences ranging from deeply technical engineers to senior executives
• Support or lead security incidents originating from penetration testing or red team findings
• Mentor other offensive security engineers and help raise the technical bar across the team
• Research emerging attack techniques and develop testing methodologies for new technologies and attack surfaces

Skills

• 5+ years of experience in offensive security, red teaming, advanced penetration testing, or closely related security disciplines
• Demonstrated hands-on experience red teaming and penetration testing modern web applications
• Demonstrated hands-on experience conducting mobile application security assessments across iOS and/or Android environments
• Strong understanding of modern web and mobile attack surfaces, including authentication, authorization, APIs, business logic, client-side security, and application architecture
• Experience designing and executing realistic, multi-stage attack scenarios rather than relying solely on automated vulnerability scanning
• Deep understanding of common network protocols and technologies including DNS and TCP/IP
• Strong experience operating in macOS and Linux environments
• Experience attacking modern software development and infrastructure environments, including CI/CD pipelines, Kubernetes, Docker, AWS and/or GCP
• Knowledge of defensive security technologies and techniques including EDR, IDS/IPS, packet capture, network analysis, endpoint security, and methods used to evade or bypass them
• Deep understanding of the MITRE ATT&CK framework and how adversary techniques map to real-world offensive operations
• Strong knowledge of identity, authentication, authorization, and access-control security fundamentals
• Ability to read and write code in languages such as Python, Go, and JavaScript
• Ability to independently research unfamiliar technologies, develop an offensive testing methodology, and execute against it
• Strong written and verbal communication skills with the ability to translate technical vulnerabilities into clear business risk
• A remediation-focused mindset — you care about helping teams fix vulnerabilities, not simply finding them
• Experience mentoring or developing other security engineers
• Ability to operate effectively within distributed, highly collaborative engineering teams
• Strong written communication across tools such as Slack, Jira, GitHub, and email

Benefits

• Significant equity

Company Overview