Senior Security Engineer

We are seeking a Senior Security Engineer who combines the mindset of a developer with the skills of a pentester, capable of orchestrating, scripting, and chaining network and web application exploits to run autonomously.

Responsibilities

• Sequence vulnerabilities together to achieve advanced exploitation outcomes, such as pairing low-severity information disclosure with SSRF to achieve Remote Code Execution
• Write custom exploits and automate complex multi-stage authentication scripts
• Configure and scale continuous, automated security validation tools and frameworks
• Apply deep knowledge of the OSI model and core network protocols to identify and address infrastructure vulnerabilities
• Assess and remediate web application vulnerabilities, including OWASP Top 10 issues and API flaws like IDOR
• Engineer automated exploit scripts that safely validate vulnerabilities without crashing live network infrastructure or corrupting production databases
• Conduct threat modeling exercises to anticipate and mitigate potential attack vectors
• Manage vulnerability identification, prioritization, and remediation processes across systems
• Leverage cyber threat intelligence to inform security validation strategies and exploit development

Requirements

• 5+ years of experience in security engineering, penetration testing, or related roles
• Expertise in exploit chaining and logic, with proven ability to sequence vulnerabilities for advanced exploitation
• Proficiency in Python for scripting custom exploits and automation
• Knowledge of cyber threat intelligence, threat modeling, and vulnerability management practices
• Familiarity with OWASP Top 10 vulnerabilities and API security flaws such as IDOR
• Background in configuring automated security validation tools and frameworks
• Understanding of the OSI model and core network protocols, including DNS, BGP, and TCP/IP
• Proficiency in English at a B2+ level

Nice to have

• Skills in Bash and Go Language for scripting and automation
• Familiarity with OAuth and Multi-Factor Authentication implementation and exploitation techniques