Senior Attack Engineer, External

🔥 15 hours ago

🇺🇸 United States – Remote

💵 $206.3k - $242.7k / year

⏰ Full Time

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 20%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Horizon3.ai

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2019

🔒 Cybersecurity

🤖 Artificial Intelligence

☁️ SaaS

Cybersecurity • Artificial Intelligence • SaaS

Horizon3. ai is a cybersecurity company that specializes in autonomous penetration testing through its platform, NodeZero. The company's mission is to proactively identify and address attack vectors before they can be exploited, allowing organizations to continuously assess their security posture across various environments including cloud, IoT, and on-premises systems. Founded by veterans from the US Special Operations and National Security sectors, Horizon3. ai offers a self-service SaaS solution that provides organizations with insights into their security vulnerabilities without requiring persistent or credentialed agents.

📋 Description

• Design, build, and maintain highly scalable reconnaissance workflows in production-grade Python • Research, explore, and parse large volumes of external-facing data into accurate, actionable information • Develop parsing and enrichment for unstructured banners, web content, documents, and error output • Collect, store, and connect high volumes of information • Extend attack-path modeling and graph data models for identity, privilege, and relationship paths • Traverse external identity relationships across accounts, tenants, SSO, federation, exposed credentials, and third-party services • Automate multi-step attack workflows from discovery through credential access, initial access, and post-exploitation • Research emerging external tradecraft and turn it into production attack content • Maintain representative test environments for attack-scenario validation and regression testing • Build production-safe workflows respecting target environments, rate limits, and scope • Contribute to priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques • Mentor teammates and help define engineering standards • Collaborate with engineers, product managers, and customer-facing teams • Author internal documentation and external research and blog posts

🎯 Requirements

• Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation • 5+ years of hands-on experience in offensive security, security research, and/or security-focused software engineering • Recent experience building and shipping offensive tooling • Experience building reconnaissance and discovery systems that run at scale • Strong skill researching and parsing large amounts of messy, unstructured external data • Experience collecting, storing, and connecting high volumes of data and reasoning about identities, assets, and trust relationships • Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and movement among identities, tenants, and services • Experience automating multi-step attack workflows end to end • Strong software engineering fundamentals with Python • Track record of shipping and maintaining production-quality code • Ability to independently research unfamiliar systems and technologies • Strong written and verbal communication and technical documentation skills • Passion for building products • OSCP, OSEP, CRTO, or equivalent offensive certifications are advantageous • Experience with certificate transparency, passive DNS, and internet-wide scanning • Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, and AWS • Experience with external-to-internal pivoting • Experience with graph databases, attack-path analysis, data lakes, and high-volume data processing • Experience developing or contributing to offensive or reconnaissance tooling • Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs • Experience building production-safe autonomous or automated offensive tooling • Legally authorized to work in the United States

🏖️ Benefits

• Equity package in the form of stock options for all full-time roles • Health, vision & dental insurance for you and your family • Flexible vacation policy • Generous parental leave • Career development opportunities • Inclusive and collaborative culture • Remote work