Staff Attack Engineer, External

🕒 Outubro 19

🇺🇸 Estados Unidos – Remoto (EUA)

💵 $238.000 - $280.000 / ano

⏰ Tempo Integral

🔴 Especialista

👷🏻‍♀️ Engenheiro

👻 Score fantasma 20%

O que significa: a chance de ninguém estar realmente contratando para esta vaga.Como ler: 60% ou mais significa que achamos que é uma vaga fantasma. Pontuações mais baixas preocupam menos.Como pontuamos: tempo em aberto, republicações, vagas abertas vs tamanho do time, rapidez para fechar vagas, e se o salário está divulgado.Observação: é uma estimativa de dados públicos, não um julgamento da empresa. Vagas reais podem ter pontuação alta, então use como uma dica, não como um fato.

Candidatar-se

Encontrar Vagas Remotas Similares

Horizon3.ai

SiteLinkedInTodas as Vagas

51 - 200 funcionários

Fundada em 2019

🔒 Cibersegurança

🤖 Inteligência Artificial

☁️ SaaS

Cybersecurity • Artificial Intelligence • SaaS

A plataforma NodeZero™ capacita sua organização a continuamente encontrar, corrigir e verificar sua superfície de ataque explorável. Reduza seu risco de segurança ao encontrar autonomamente fraquezas em sua rede, sabendo como priorizá-las e corrigi-las, e verificando imediatamente se suas correções funcionam. O NodeZero oferece pentests autônomos seguros para produção e outras operações de avaliação chave que escalam através de seus maiores ambientes internos, externos, em nuvem e em nuvem híbrida. Sem necessidade de agentes, sem código para escrever e sem consultores para contratar. Somos uma fusão de ex-operadores cibernéticos das Operações Especiais dos EUA, engenheiros de startups e praticantes de cibersegurança anteriormente frustrados. Estamos comprometidos em ajudar a resolver nossos problemas comuns de segurança: ferramentas de segurança ineficazes, falsos positivos resultando em fadiga de alerta, pontos cegos, cultura de segurança "para cumprir tabela", escassez de habilidades em cibersegurança e o longo tempo e custo de contratar consultores externos.

Descrição

• Design, build, and maintain highly scalable reconnaissance workflows in production-grade Python • Research, explore, and parse large volumes of external-facing data into accurate, actionable information • Develop parsing and enrichment for free-form banners, web content, documents, and error output • Collect, store, and connect high volumes of information • Extend attack-path modeling and graph data models for identity, privilege, and relationship paths • Traverse identity relationships across accounts, tenants, SSO and federation, exposed credentials, and third-party services • Automate multi-step attack workflows from discovery and credential access through initial access and post-exploitation • Research emerging external tradecraft and turn it into production attack content • Maintain representative test environments for validating and regression-testing attack scenarios • Build for production safety and scale while respecting target environments, rate limits, and scope • Set priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques • Mentor and level up attack engineers • Collaborate with engineers, product managers, and customer-facing teams • Author internal documentation and external research and blog posts

🎯 Requisitos

• Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation • 10+ years of hands-on experience in offensive security, security research, or security-focused software engineering • Recent experience building and shipping offensive tooling • Experience building reconnaissance and discovery systems that run at scale • Strong skill researching and parsing large amounts of messy, unstructured external data • Experience collecting, storing, and connecting high volumes of data and reasoning about relationships such as identities, assets, and trust • Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and movement among identities, tenants, and services • Experience automating multi-step attack workflows end to end • Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code • Ability to independently research unfamiliar systems and technologies • Strong written and verbal communication, including clear technical documentation • Passion for building products, not just finding vulnerabilities • OSCP, OSEP, CRTO, or equivalent offensive certification is an advantage • Experience with certificate transparency, passive DNS, and internet-wide scanning is an advantage • Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, AWS, and on-premises-to-cloud pivots is an advantage • Experience with external-to-internal pivoting is an advantage • Experience with graph databases, attack-path analysis, data lakes, and high-volume data storage and processing is an advantage • Experience developing or contributing to offensive or reconnaissance tooling is an advantage • Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs are an advantage • Experience building production-safe autonomous or automated offensive tooling is an advantage • Legally authorized to work in the United States

🏖️ Benefícios

• Equity package in the form of stock options for all full-time roles • Health, vision and dental insurance for you and your family • Flexible vacation policy • Generous parental leave • Career development opportunities • Collaborative and innovative work environment • Fully remote work arrangement • Up to 5% travel

📊 Verifique sua pontuação de currículo para esta vaga

Melhore suas chances de conseguir uma entrevista verificando sua pontuação de currículo antes de se candidatar.

Enviar Currículo