Staff Attack Engineer, External

🕒 vor 22 Tagen

🇺🇸 Vereinigte Staaten – Remote

💵 $238.000 - $280.000 / Jahr

⏰ Vollzeit

🔴 Experte

👷🏻‍♀️ Ingenieur

👻 Geisterscore 20%

Was es bedeutet: die Wahrscheinlichkeit, dass für diese Stelle niemand wirklich einstellt.So liest du es: 60 % oder höher heißt, wir halten das für einen Geisterjob. Niedrigere Werte sind weniger bedenklich.Warum dieser Wert:

• Seit 22 Tagen offen.
• Stellen bei diesem Unternehmen werden meist in 39 Tagen besetzt.
• 180 offene Stellen bei 110 Mitarbeitenden.

Jetzt Bewerben

Ähnliche Remote-Jobs finden

Horizon3.ai

WebsiteLinkedInAlle Stellen

51 - 200 Mitarbeiter

Gegründet 2019

🔒 Cybersecurity

🤖 Künstliche Intelligenz

☁️ SaaS

Cybersecurity • Artificial Intelligence • SaaS

Die NodeZero™-Plattform befähigt Ihr Unternehmen, Ihre ausnutzbare Angriffsfläche kontinuierlich zu identifizieren, zu beheben und die Wirksamkeit der Maßnahmen zu verifizieren. Reduzieren Sie Ihr Sicherheitsrisiko, indem Sie Schwachstellen in Ihrem Netzwerk autonom finden, wissen, wie Sie sie priorisieren und beheben, und umgehend verifizieren, dass Ihre Maßnahmen wirken. NodeZero liefert produktionssichere, autonome Penetrationstests sowie weitere zentrale Assessments, die über Ihre größten internen, externen, Cloud- und Hybrid-Cloud-Umgebungen skalieren. Keine Agents erforderlich, kein Code zu schreiben, keine Berater zu beauftragen.

Beschreibung

• Design, build, and maintain highly scalable reconnaissance workflows in production-grade Python • Research, explore, and parse large volumes of external-facing data into accurate, actionable information • Develop parsing and enrichment for free-form banners, web content, documents, and error output • Collect, store, and connect high volumes of information • Extend attack-path modeling and graph data models for identity, privilege, and relationship paths • Traverse identity relationships across accounts, tenants, SSO and federation, exposed credentials, and third-party services • Automate multi-step attack workflows from discovery and credential access through initial access and post-exploitation • Research emerging external tradecraft and turn it into production attack content • Maintain representative test environments for validating and regression-testing attack scenarios • Build for production safety and scale while respecting target environments, rate limits, and scope • Set priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques • Mentor and level up attack engineers • Collaborate with engineers, product managers, and customer-facing teams • Author internal documentation and external research and blog posts

🎯 Anforderungen

• Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation • 10+ years of hands-on experience in offensive security, security research, or security-focused software engineering • Recent experience building and shipping offensive tooling • Experience building reconnaissance and discovery systems that run at scale • Strong skill researching and parsing large amounts of messy, unstructured external data • Experience collecting, storing, and connecting high volumes of data and reasoning about relationships such as identities, assets, and trust • Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and movement among identities, tenants, and services • Experience automating multi-step attack workflows end to end • Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code • Ability to independently research unfamiliar systems and technologies • Strong written and verbal communication, including clear technical documentation • Passion for building products, not just finding vulnerabilities • OSCP, OSEP, CRTO, or equivalent offensive certification is an advantage • Experience with certificate transparency, passive DNS, and internet-wide scanning is an advantage • Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, AWS, and on-premises-to-cloud pivots is an advantage • Experience with external-to-internal pivoting is an advantage • Experience with graph databases, attack-path analysis, data lakes, and high-volume data storage and processing is an advantage • Experience developing or contributing to offensive or reconnaissance tooling is an advantage • Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs are an advantage • Experience building production-safe autonomous or automated offensive tooling is an advantage • Legally authorized to work in the United States

🏖️ Vorteile

• Equity package in the form of stock options for all full-time roles • Health, vision and dental insurance for you and your family • Flexible vacation policy • Generous parental leave • Career development opportunities • Collaborative and innovative work environment • Fully remote work arrangement • Up to 5% travel

📊 Überprüfen Sie Ihre Lebenslauf-Bewertung für diese Stelle

Verbessern Sie Ihre Chancen auf ein Vorstellungsgespräch, indem Sie Ihre Lebenslauf-Bewertung vor der Bewerbung überprüfen.

Lebenslauf hochladen