Staff Attack Engineer, External

🔥 15 hours ago

🇺🇸 United States – Remote

💵 $238k - $280k / year

⏰ Full Time

🔴 Lead

👷🏻‍♀️ Engineer

👻 Ghost score 20%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Horizon3.ai

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2019

🔒 Cybersecurity

🤖 Artificial Intelligence

☁️ SaaS

Cybersecurity • Artificial Intelligence • SaaS

Horizon3. ai is a cybersecurity company that specializes in autonomous penetration testing through its platform, NodeZero. The company's mission is to proactively identify and address attack vectors before they can be exploited, allowing organizations to continuously assess their security posture across various environments including cloud, IoT, and on-premises systems. Founded by veterans from the US Special Operations and National Security sectors, Horizon3. ai offers a self-service SaaS solution that provides organizations with insights into their security vulnerabilities without requiring persistent or credentialed agents.

📋 Description

• Design, build, and maintain highly scalable reconnaissance workflows in production-grade Python • Research, explore, and parse large volumes of external-facing data into accurate, actionable information • Develop parsing and enrichment for free-form banners, web content, documents, and error output • Collect, store, and connect high volumes of information • Extend attack-path modeling and graph data models for identity, privilege, and relationship paths • Traverse identity relationships across accounts, tenants, SSO and federation, exposed credentials, and third-party services • Automate multi-step attack workflows from discovery and credential access through initial access and post-exploitation • Research emerging external tradecraft and turn it into production attack content • Maintain representative test environments for validating and regression-testing attack scenarios • Build for production safety and scale while respecting target environments, rate limits, and scope • Set priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques • Mentor and level up attack engineers • Collaborate with engineers, product managers, and customer-facing teams • Author internal documentation and external research and blog posts

🎯 Requirements

• Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation • 10+ years of hands-on experience in offensive security, security research, or security-focused software engineering • Recent experience building and shipping offensive tooling • Experience building reconnaissance and discovery systems that run at scale • Strong skill researching and parsing large amounts of messy, unstructured external data • Experience collecting, storing, and connecting high volumes of data and reasoning about relationships such as identities, assets, and trust • Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and movement among identities, tenants, and services • Experience automating multi-step attack workflows end to end • Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code • Ability to independently research unfamiliar systems and technologies • Strong written and verbal communication, including clear technical documentation • Passion for building products, not just finding vulnerabilities • OSCP, OSEP, CRTO, or equivalent offensive certification is an advantage • Experience with certificate transparency, passive DNS, and internet-wide scanning is an advantage • Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, AWS, and on-premises-to-cloud pivots is an advantage • Experience with external-to-internal pivoting is an advantage • Experience with graph databases, attack-path analysis, data lakes, and high-volume data storage and processing is an advantage • Experience developing or contributing to offensive or reconnaissance tooling is an advantage • Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs are an advantage • Experience building production-safe autonomous or automated offensive tooling is an advantage • Legally authorized to work in the United States

🏖️ Benefits

• Equity package in the form of stock options for all full-time roles • Health, vision and dental insurance for you and your family • Flexible vacation policy • Generous parental leave • Career development opportunities • Collaborative and innovative work environment • Fully remote work arrangement • Up to 5% travel