Senior Attack Engineer, External

🕒 Outubro 19

🇺🇸 Estados Unidos – Remoto (EUA)

💵 $206.278 - $242.680 / ano

⏰ Tempo Integral

🟠 Sênior

👷🏻‍♀️ Engenheiro

👻 Score fantasma 25%

O que significa: a chance de ninguém estar realmente contratando para esta vaga.Como ler: 60% ou mais significa que achamos que é uma vaga fantasma. Pontuações mais baixas preocupam menos.Como pontuamos: tempo em aberto, republicações, vagas abertas vs tamanho do time, rapidez para fechar vagas, e se o salário está divulgado.Observação: é uma estimativa de dados públicos, não um julgamento da empresa. Vagas reais podem ter pontuação alta, então use como uma dica, não como um fato.

Candidatar-se

Encontrar Vagas Remotas Similares

Horizon3.ai

SiteLinkedInTodas as Vagas

51 - 200 funcionários

Fundada em 2019

🔒 Cibersegurança

🤖 Inteligência Artificial

☁️ SaaS

Cybersecurity • Artificial Intelligence • SaaS

A plataforma NodeZero™ capacita sua organização a continuamente encontrar, corrigir e verificar sua superfície de ataque explorável. Reduza seu risco de segurança ao encontrar autonomamente fraquezas em sua rede, sabendo como priorizá-las e corrigi-las, e verificando imediatamente se suas correções funcionam. O NodeZero oferece pentests autônomos seguros para produção e outras operações de avaliação chave que escalam através de seus maiores ambientes internos, externos, em nuvem e em nuvem híbrida. Sem necessidade de agentes, sem código para escrever e sem consultores para contratar. Somos uma fusão de ex-operadores cibernéticos das Operações Especiais dos EUA, engenheiros de startups e praticantes de cibersegurança anteriormente frustrados. Estamos comprometidos em ajudar a resolver nossos problemas comuns de segurança: ferramentas de segurança ineficazes, falsos positivos resultando em fadiga de alerta, pontos cegos, cultura de segurança "para cumprir tabela", escassez de habilidades em cibersegurança e o longo tempo e custo de contratar consultores externos.

Descrição

• Design, build, and maintain scalable reconnaissance workflows in production-grade Python • Research, explore, and parse large volumes of external-facing data into accurate, actionable information • Develop parsing and enrichment for free-form banners, web content, documents, and error output • Collect, store, and connect high volumes of information • Extend attack-path modeling and graph data models for identity, privilege, and relationship paths • Traverse external identity relationships across accounts, tenants, SSO, federation, exposed credentials, and third-party services • Automate multi-step attack workflows from discovery and credential access through initial access and post-exploitation • Research emerging external tradecraft and turn it into production attack content • Maintain representative test environments for validation, demonstration, and regression testing • Build for production safety and scale while respecting targets, customers, rate limits, and scope • Contribute to priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques • Mentor teammates and help define standards for code quality, research rigor, and operational safety • Collaborate with engineers, product managers, and customer-facing teams • Author internal documentation and external research and blog posts

🎯 Requisitos

• Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation • 5+ years of hands-on experience in offensive security, security research, and/or security-focused software engineering, with recent work building and shipping offensive tooling • Experience building reconnaissance and discovery systems that run at scale • Strong skill researching and parsing large amounts of messy, unstructured external data • Experience collecting, storing, and connecting high volumes of data and reasoning about identities, assets, and trust relationships • Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and identity, tenant, and service traversal • Experience automating multi-step attack workflows end to end • Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code • Ability to independently research unfamiliar systems and technologies and build practical expertise • Strong written and verbal communication, including technical documentation • Passion for building products, not just finding vulnerabilities • OSCP, OSEP, CRTO, or equivalent offensive certifications • Experience with certificate transparency, passive DNS, and internet-wide scanning • Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, and AWS • Experience with external-to-internal pivoting • Experience with graph databases, attack-path analysis, data lakes, and high-volume data processing • Experience developing or contributing to offensive or reconnaissance tooling • Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs • Experience building production-safe autonomous or automated offensive tooling • Must be legally authorized to work in the United States

🏖️ Benefícios

• Equity package in the form of stock options for all full-time roles • Health, vision & dental insurance for you and your family • Flexible vacation policy • Generous parental leave • Career development opportunities • Collaborative and innovative work environment • Remote and hybrid work models depending on role and location • Inclusive culture • Up to 5% travel may be required

📊 Verifique sua pontuação de currículo para esta vaga

Melhore suas chances de conseguir uma entrevista verificando sua pontuação de currículo antes de se candidatar.

Enviar Currículo