Senior Offensive Security Engineer

Job Title: Senior Offensive Security Engineer

• Lead Red Team Operations:

  Scope, design and lead end-to-end global adversary emulation campaigns targeting complex enterprise infrastructure, hybrid cloud environments, supply chains and specialized hardware.

• CI/CD & DevSecOps Exploitation:

  Orchestrate attack and exploit modern DevOps pipelines (e.g., GitHub Actions, GitLab CI, Jenkins). Inject malicious code, abuse runner configurations, exploit infrastructure-as-code (IaC) misconfigurations and hijack software supply chains to pivot into production environments.

• IoT :

  Perform physical and logical security assessments on enterprise IoT devices, embedded systems and proprietary hardware. Execute firmware reverse engineering, extract cryptographic keys and abuse hardware communication protocols (e.g., UART, JTAG, SPI) to gain network footholds.

• Custom Infrastructure & C2 Construction:

  Architect, deploy and manage highly resilient, covert Command-and-Control (C2) infrastructure using advanced redirectors, domain fronting and custom C2 frameworks (e.g., Cobalt Strike, Mythic, Sliver).

• Executive Reporting & Risk Communication:

  Translate highly technical, multi-step attack paths into impactful executive summaries and risk reports for C-level executives (CISO/CIO) to drive security budget and architecture decisions.

• Mentorship & Leadership:

  Act as a technical mentor to junior and mid-level pentesters/red teamers, establishing methodologies, peer-reviewing report quality and driving the teams research and development (R&D) efforts.

Required Skills & Qualifications

• Experience:

  3-8 years of dedicated experience in offensive security roles, with a proven track record of leading complex Red Team operations or advanced adversary emulation engagements.

• DevSecOps & Supply Chain Mastery:

  Deep understanding of modern software development life cycles (SDLC). Proven ability to compromise secrets management vaults (e.g., HashiCorp Vault, AWS Secrets Manager), poison build environments and abuse container orchestrators (Kubernetes, Docker).

• IoT & Embedded Security Skills:

  Hands-on experience with hardware reverse engineering, debugging firmware and utilizing hardware hacking tools (e.g., Bus Pirate, Logic Analyzers, JTAGulators).

• Expert Evasion Techniques:

  Advanced knowledge of Windows/Linux internals, API unhooking, direct system calls (Syscalls), process injection and memory patching to evade top-tier EDR and SIEM platforms.

• Software Development Mastery:

  Proficient in low-level programming or deep scripting languages (e.g., C/C++, C#, Go, Python) for custom tool building, reverse engineering, and exploit refinement.

• Threat Intelligence Integration:

  Ability to analyze Cyber Threat Intelligence (CTI) reports and reverse-engineer real-world threat actor TTPs (Tactics, Techniques, and Procedures) to replicate specific adversary groups.

Preferred Certifications

• DevSecOps/Cloud:

  Certified DevSecOps Professional (CDP)

  or

  PACES

  (Professional Azure Security Expert)
• OffSec:

  OSEP

  (OffSec Experienced Pentester) or

  OSED

  (OffSec Exploitation Developer)
• Altered Security:

  CRTE

  (Certified Red Team Expert)
• SANS / GIAC:

  GXPN

  (GIAC Exploit Researcher and Advanced Penetration Tester)