Senior Attack Engineer, External

🕒 October 19

🇺🇸 United States – Remote

💵 $206.3k - $242.7k / year

⏰ Full Time

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 25%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Horizon3.ai

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2019

🔒 Cybersecurity

🤖 Artificial Intelligence

☁️ SaaS

Cybersecurity • Artificial Intelligence • SaaS

Horizon3. ai is a cybersecurity company that specializes in autonomous penetration testing through its platform, NodeZero. The company's mission is to proactively identify and address attack vectors before they can be exploited, allowing organizations to continuously assess their security posture across various environments including cloud, IoT, and on-premises systems. Founded by veterans from the US Special Operations and National Security sectors, Horizon3. ai offers a self-service SaaS solution that provides organizations with insights into their security vulnerabilities without requiring persistent or credentialed agents.

📋 Description

• Design, build, and maintain scalable reconnaissance workflows in production-grade Python • Research, explore, and parse large volumes of external-facing data into accurate, actionable information • Develop parsing and enrichment for free-form banners, web content, documents, and error output • Collect, store, and connect high volumes of information • Extend attack-path modeling and graph data models for identity, privilege, and relationship paths • Traverse external identity relationships across accounts, tenants, SSO, federation, exposed credentials, and third-party services • Automate multi-step attack workflows from discovery and credential access through initial access and post-exploitation • Research emerging external tradecraft and turn it into production attack content • Maintain representative test environments for validation, demonstration, and regression testing • Build for production safety and scale while respecting targets, customers, rate limits, and scope • Contribute to priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques • Mentor teammates and help define standards for code quality, research rigor, and operational safety • Collaborate with engineers, product managers, and customer-facing teams • Author internal documentation and external research and blog posts

🎯 Requirements

• Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation • 5+ years of hands-on experience in offensive security, security research, and/or security-focused software engineering, with recent work building and shipping offensive tooling • Experience building reconnaissance and discovery systems that run at scale • Strong skill researching and parsing large amounts of messy, unstructured external data • Experience collecting, storing, and connecting high volumes of data and reasoning about identities, assets, and trust relationships • Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and identity, tenant, and service traversal • Experience automating multi-step attack workflows end to end • Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code • Ability to independently research unfamiliar systems and technologies and build practical expertise • Strong written and verbal communication, including technical documentation • Passion for building products, not just finding vulnerabilities • OSCP, OSEP, CRTO, or equivalent offensive certifications • Experience with certificate transparency, passive DNS, and internet-wide scanning • Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, and AWS • Experience with external-to-internal pivoting • Experience with graph databases, attack-path analysis, data lakes, and high-volume data processing • Experience developing or contributing to offensive or reconnaissance tooling • Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs • Experience building production-safe autonomous or automated offensive tooling • Must be legally authorized to work in the United States

🏖️ Benefits

• Equity package in the form of stock options for all full-time roles • Health, vision & dental insurance for you and your family • Flexible vacation policy • Generous parental leave • Career development opportunities • Collaborative and innovative work environment • Remote and hybrid work models depending on role and location • Inclusive culture • Up to 5% travel may be required

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume