offensive security engineer

noon

<div>
 
 
 Who are we?
 
 
 
 Noon, the region's leading consumer commerce platform. On December 12th, 2017, Noon launched its consumer platform in Saudi Arabia and the UAE, expanding to Egypt in February 2019. The noon ecosystem of services now includes marketplaces for food delivery, quick-commerce, fintech, and fashion. Noon is a work in progress; we&rsquo;re six years in, but only 5% done. Noon&rsquo;s mission: every door, every day.
 
 
 
 
 
 
 
 
 
 
 What you'll do:
 
 
 
 
 
 
 We are looking for a highly-motivated and dynamic candidate to join our Red Team and who will support our red teaming security program and offensive security operations. The candidate is expected to participate in Red Team/Purple team operations/penetration testing and adversary emulation assessments. Additionally, the candidate will assist Noon&rsquo;s company in enhancing their cybersecurity resilience by providing an "attacker's approach" and identifying high-impact attack vectors that threat actors could use.
 
 
 
 
 
 
 An ideal candidate should have a passion for red teaming, must demonstrate technically sound offensive security skills, and have an attacker mindset. The candidate is also expected to coordinate across the infosec department to plan and oversee the execution of assessments, as well as assist in helping improve Noon security defense.
 
 
 
 
 
 
 Key Responsibilities:
 
 
 
 
 
 <ul>
 <li>
 Conduct deep app-level offensive testing, own CVEs or patch-diff research, and produce validated PoCs.
 </li>
 <li>
 Run continuous security reviews, eliminate false positives, and optimize detection patterns for higher accuracy.
 </li>
 <li>
 Design and build scalable security tools, identify and fix problems proactively without waiting for direction.
 </li>
 <li>
 Assist in overseeing the design, implementation, and delivery of Red Team assessments, including the pentesting, reporting, and metrics.
 </li>
 <li>
 Function as a SME (Subject-Matter Expert) and primary contact to coordinate Red Team activities, organize and lead penetration testing activities.
 </li>
 <li>
 Run the day-to-day red team operations and working with other red teamers to deliver high-quality assessments focused on infrastructure, mobile, and web applications, purple team, wireless and social engineering.
 </li>
 <li>
 Plan and perform adversarial simulated attacks against organizations' services, platforms, and infrastructures, to detect security vulnerabilities ahead of the attackers.
 </li>
 <li>
 Adopt new TTPs and implement them in Red and Purple team assessments.
 </li>
 <li>
 Conduct research on new emerging threats and risks. Leading critical security initiatives (e.g., validation and re-tests, root cause analysis proof-of-concept, and process design).
 </li>
 <li>
 Provide 3rd party vendors supporting in external Penetration Tests/Red Team assessments.
 </li>
 <li>
 Assist in developing and improving the red team security program.
 </li>
 <li>
 Effectively communicate at all levels, including developing metrics and detailed reporting for communication to executive leadership and technical teams within Noon.
 </li>
 <li>
 Contribute hands-on technical expertise to the Red Team, including mentorship for junior team members and provide oversight, guidance, and support to other red team members.
 </li>
 </ul>
 
 
 
 
 
 What you'll need:
 
 
 
 
 
 <ul>
 <li>
 We are
 
 (hiring for all levels)
 
 </li>
 <li>
 Experience in performing network penetration, web and mobile application testing, source code reviews, threat analysis, wireless network assessments, and social engineering assessments
 </li>
 <li>
 Advanced knowledge of Active Directory, Windows exploitation and AV evasion techniques.
 </li>
 <li>
 In-depth knowledge with hands-on experience of advanced web applications penetration testing OR mobile applications.
 </li>
 <li>
 Ability to conduct source code reviews and define mitigation controls within source code for languages such as Python, Node.js, Java, etc.
 </li>
 <li>
 Industry certifications such as OSCE, OSWE, CRPT, GPEN, GWAPT, GXPN are desirable.
 </li>
 <li>
 Establishes industry expertise through writing, public speaking, shipping open-source projects, or online presence.
 </li>
 <li>
 Deep understanding of mapping attack surfaces, including hands-on experience with various Cybersecurity standards and technologies (MITRE ATT&amp;CK)
 </li>
 <li>
 Strong understanding of Linux and its underlying components/ Networking basics.
 </li>
 <li>
 Advanced experience in automation and hands-on experience in scripting, e.g., Bash Shell, Python/Go, and Powershell.
 </li>
 <li>
 Experience in developing red team end to end operational frameworks and standards
 </li>
 <li>
 Strong interpersonal skills with the ability to communicate and work effectively across the organization.
 </li>
 <li>
 Self-starter, ability to work independently with minimal supervision and as part of a team
 </li>
 </ul>
 
 
 
 
 
 Who will excel?
 
 
 
 
 
 
 &lsquo;noon isn&rsquo;t for everyone. And that&rsquo;s okay.&rsquo; This is one of our core operating principles.
 
 
 
 
 
 We're looking for resourceful doers. Thinkers who are both creative and analytical. Problem solvers who are enthusiastic about delivering results. Our ideal candidate will be comfortable in a fast-paced, multi-tasked, high-energy and often ambiguous environment.
 
 
 
 
 
 If the above values resonate with you, then noon might be the place for you.
 
</div>

Red Team / Offensive Security Engineer (Hiring for all levels)

Mercor

<div>
 
 About The Job
 
 
 
 
 Mercor
 
 connects elite creative and technical talent with leading AI research labs. Headquartered in San Francisco, our investors include
 
 Benchmark
 
 ,
 
 General Catalyst
 
 ,
 
 Peter Thiel
 
 ,
 
 Adam D'Angelo
 
 ,
 
 Larry Summers
 
 , and
 
 Jack Dorsey
 
 .
 
 
 
 Position:
 
 Red Team Specialist
 
 
 
 Type:
 
 
 Full-time or Part-time Contract Work
 
 
 
 
 Compensation:
 
 
 $29/hour
 
 
 
 
 Location:
 
 
 Remote
 
 ; Geography restricted to
 
 USA, Brazil
 
 
 
 
 Role Responsibilities
 
 
 
 <ul>
 <li>
 Evaluate conversational AI models for vulnerabilities through jailbreaks, prompt injections, and misuse cases.
 </li>
 <li>
 Generate high-quality human data by annotating failures, classifying vulnerabilities, and flagging systemic risks.
 </li>
 <li>
 Apply structure by following taxonomies, benchmarks, and playbooks to maintain consistent testing.
 </li>
 <li>
 Document reproducibly by producing reports, datasets, and attack cases that customers can act on.
 </li>
 <li>
 Work independently and asynchronously to meet deadlines while improving AI model performance.
 
 
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 
 Must-Have
 
 
 
 <ul>
 <li>
 Prior experience in red teaming (AI adversarial work, cybersecurity, socio-technical probing).
 </li>
 <li>
 Native-level fluency in English and Brazilian Portuguese.
 </li>
 <li>
 Strong communication skills to explain risks clearly to technical and non-technical stakeholders.
 
 
 
 </li>
 </ul>
 
 Preferred
 
 
 
 <ul>
 <li>
 Experience in Adversarial ML (jailbreak datasets, prompt injection, RLHF/DPO attacks, model extraction).
 </li>
 <li>
 Background in Cybersecurity (penetration testing, exploit development, reverse engineering).
 </li>
 <li>
 Expertise in Socio-technical risk (harassment/disinfo probing, abuse analysis, conversational AI testing).
 
 
 
 </li>
 </ul>
 
 Compensation &amp; Legal
 
 
 
 <ul>
 <li>
 Hourly contractor, Paid weekly.
 
 
 
 </li>
 </ul>
 
 Application Process (Takes 20&ndash;30 mins to complete)
 
 
 
 <ul>
 <li>
 Upload resume
 </li>
 <li>
 AI interview based on your resume
 </li>
 <li>
 Submit form
 
 
 
 </li>
 </ul>
 
 Resources &amp; Support
 
 
 
 <ul>
 <li>
 For details about the interview process and platform information, please check: https://talent.docs.mercor.com/welcome/welcome
 </li>
 <li>
 For any help or support, reach out to: support@mercor.com
 
 
 
 </li>
 </ul>
 
 PS: Our team reviews applications daily. Please complete your AI interview and application steps to be considered for this opportunity.
 
</div>

Adversarial AI Offensive Security Engineer

Microsoft

<div>
 
 Overview
 
 
 
 Do you want to help secure some of Microsoft&rsquo;s most critical and high‑impact online services?
 
 
 Are you passionate about solving hard security problems, learning offensive security techniques, and building skills that shape the future of secure cloud computing?
 
 
 The Microsoft Specialized Clouds (MSC) Security Fundamentals group is responsible for securing some of Microsoft&rsquo;s largest and most influential online services. The SERPENT team is looking for a Security Engineer with strong interest in penetration testing, vulnerability assessment, and security research to help strengthen the security posture of these services.
 
 
 This role is an excellent fit for early-in-career engineers who want to build deep expertise in offensive security while contributing to real‑world impact.
 
 
 
 Microsoft&rsquo;s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.
 
 
 
 
 Responsibilities
 
 
 
 
 Penetration Testing
 
 
 
 <ul>
 <li>
 Identify security vulnerabilities and variants across critical cloud services.
 </li>
 <li>
 Perform source code reviews, dynamic analysis, and operational security assessments.
 </li>
 <li>
 Validate software quality and adherence to security development practices.
 </li>
 <li>
 Work with engineering and defense teams to improve detection, response, and operational awareness.
 
 
 </li>
 </ul>
 
 Security Automation
 
 
 
 <ul>
 <li>
 Contribute to static and runtime analysis capabilities to detect software security issues.
 </li>
 <li>
 Help design automated analysis workflows for managed code and modern web services.
 </li>
 <li>
 Explore and prototype automation that improves consistency, speed, and depth of security assessments.
 
 
 </li>
 </ul>
 
 Research, Training, and Tool Development
 
 
 
 <ul>
 <li>
 Stay current on offensive security tactics, penetration testing tools, and defensive techniques.
 </li>
 <li>
 Conduct research that supports training and awareness for internal engineering teams.
 </li>
 <li>
 Support innovation efforts across MSC Security, including tooling, methodology improvements, and knowledge sharing.
 
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 
 Required Qualifications:
 
 
 
 <ul>
 <li>
 Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field
 </li>
 <ul>
 <li>
 OR equivalent experience.
 
 </li>
 </ul>
 </ul>
 
 Preferred Qualifications
 
 
 
 <ul>
 <li>
 Master's Degree in Statistics, Mathematics, Computer Science, or related field OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 2+ years&rsquo; experience in security or related field OR equivalent experience.
 </li>
 <li>
 Experience with one or more of the following is a plus:
 </li>
 <li>
 Penetration testing
 </li>
 <li>
 Vulnerability research
 </li>
 <li>
 Scripting/automation
 </li>
 <li>
 Threat Hunting
 </li>
 <li>
 Detection Engineering
 
 
 </li>
 </ul>
 Penetration Testing IC2 - The typical base pay range for this role across the U.S. is USD $84,200 - $165,200 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $109,000 - $180,400 per year.
 
 
 Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
 
 
 https://careers.microsoft.com/us/en/us-corporate-pay
 
 
 This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
 
 
 Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about
 
 requesting accommodations.
 
</div>

Penetration Tester

Uber

<div>About the Role
 
 
As AI systems-especially agentic and autonomous AI-become deeply embedded in our products and internal platforms, the security model must evolve. Traditional application security alone is no longer sufficient. We are looking for an AI Red Team Engineer to help us proactively identify, understand, and mitigate AI-native and agent-specific security risks before they reach production.
 
 
In this role, you will build and execute adversarial red-teaming exercises against AI models and AI agents, focusing on how they can be manipulated into unsafe, unintended, or harmful behavior. You will work closely with AI platform teams, product engineers, and security partners to stress-test agent logic, tool usage, memory, and autonomy-and translate findings into concrete guardrails and defenses.
 
 
This role is ideal for someone who enjoys thinking like an attacker, understands modern AI systems, and wants to work at the intersection of security, AI, and real-world impact.
- What the Candidate Will Do -
 
 
This role sits at the intersection of offensive security and AI engineering. You will not be limited to traditional penetration testing; instead, you will focus on behavioral, logical, and contextual attacks that cause AI systems to fail in subtle but dangerous ways-often without exploiting classic vulnerabilities. Success in this role means uncovering unknown unknowns,&quot; clearly articulating risk, and helping teams build safer AI systems by design.
 
 
Design and execute AI red-teaming exercises against LLMs and AI agents, including:
 
<ul><li>prompt injection (direct &amp; indirect)
</li><li>jailbreaking and policy bypass
</li><li>model and tool poisoning
</li><li>memory and context poisoning
</li><li>behavioral drift and unsafe autonomy
</li><li>tool misuse and emergent privilege escalation
</li></ul> 
Analyze agent workflows, logic, and tool graphs to identify systemic security weaknesses beyond prompt-level attacks.
 
 
Develop reusable adversarial test cases, attack libraries, and red-team playbooks for AI systems.
 
 
Collaborate with AI platform and product teams to translate red-team findings into actionable mitigations, guardrails, and design changes.
- Basic Qualifications - 
 
 
<ul><li>3+ years of experience in security engineering, offensive security, red teaming, or AI security.
</li><li>Hands-on experience red-teaming AI models or AI agents, including testing for prompt injection, jailbreaks, unsafe behavior, Excessive agency, Model DoS.
</li><li>Strong understanding of security fundamentals (threat modeling, secure design, least privilege, defense in depth).
</li><li>Ability to clearly document findings and communicate risk to both technical and non-technical stakeholders
</li><li>Proficiency in at least one programming language (e.g., Python, Go, Java, or similar)
</li></ul>- Preferred Qualifications - 
 
 
<ul><li>Familiarity with AI security tools and frameworks (e.g., PyRIT, AgentDojo, Promptfoo, custom harnesses).
</li><li>Good understanding of GenAI and LLM architectures, including: embeddings, RAG, or agent frameworks.
</li><li>Hands-on experience executing AI Red Teaming exercises, including prompt injection/jailbreaking, unsafe behavior/behavioral drift, model/tool poisoning.
</li>Offensive security / penetration testing background (e.g., red team, bug bounty, exploit development). 
<li>
</li></ul> 
 
 
 
For New York, NY-based roles: The base salary range for this role is USD$171,000 per year - USD$190,000 per year. For San Francisco, CA-based roles: The base salary range for this role is USD$171,000 per year - USD$190,000 per year. For Seattle, WA-based roles: The base salary range for this role is USD$171,000 per year - USD$190,000 per year. For Sunnyvale, CA-based roles: The base salary range for this role is USD$171,000 per year - USD$190,000 per year. For all US locations, you will be eligible to participate in Uber's bonus program, and may be offered an equity award &amp; other types of comp. All full-time employees are eligible to participate in a 401(k) plan. You will also be eligible for various benefits. More details can be found at the following link https://jobs.uber.com/en/benefits.</div>

Security Engineer (AI & Agentic Systems)

Edward Jones

<div>Innovate here. And see your ideas come to life. 
 
It's an exciting time to work in tech at Edward Jones. We are making massive investments in emerging technologies to improve how we work with our clients and with each other. Relationships are the focus of our business model. And working in Technology here means using your skills to build, deliver and maintain the technologies that enable us to deepen and support those relationships. The best part? We develop and create our own industry-leading solutions internally. And you can be a part of it. Working with emerging new technologies. Creating platforms, programs and experiences that change how we work together - and support our client-first focus. Changing the future of our firm, the industry and the advisor-client relationship. 
 
Job Overview 
 
Position Schedule: Full-Time 
 
This job posting is anticipated to remain open for 30 days, from 19-Mar-2026. The posting may close early due to the volume of applicants. 
 
Team Overview 
 
The Application Security Penetration Test team is responsible for conducting internal offensive testing and third-party facilitation for firm developed web applications deemed critical or high risk to support early identification of vulnerabilities and validation of existing controls. This reduces the likelihood of exploitation by threat actors and strengthens the organization's overall security posture. 
 
What You'll Do: 
 
As a Penetration Test Engineer IV, you will independently manage and/or facilitate third-party test engagements from scoping through reporting while contributing to the continuous improvement of secure development, DevSecOps, and cybersecurity practices. To support this, you will be responsible for: 
 
Evaluating the security of enterprise applications by conducting hands‑on penetration testing across web, API, and mobile platforms 
<ul><li>
Perform in‑depth assessments of application architectures</li><li>
Identify complex vulnerabilities, and simulate realistic attack scenarios to measure the resiliency of critical systems</li><li>
Execute both manual and tool‑assisted testing</li><li>
Collaborate with development and engineering teams to validate findings</li><li>
Provide clear remediation guidance aligned with industry's best practices</li><li>
Assists with capabilities and ensuring tools remain up to date</li><li>
Develop and mentors' junior engineers</li><li>
Contributes to building team knowledge base, creation, and annual validation of SOPs</li><li>
QA/Peer review of test scenarios and postmortem reports/evidence collection</li></ul> 
Edward Jones' compensation and benefits package includes medical and prescription drug, dental, vision, voluntary benefits (such as accident, hospital indemnity, and critical illness), short- and long-term disability, basic life, and basic AD&amp;D coverage. Short- and long-term disability, basic life, and basic AD&amp;D coverage are provided at no cost to associates. Edward Jones offers a 401k retirement plan, and tax-advantaged accounts: health savings account, and flexible spending account. Edward Jones observes ten paid holidays and provides 15 days of vacation for new associates beginning on January 1 of each year, as well as sick time, personal days, and a paid day for volunteerism. Associates may be eligible for bonuses and profit sharing. All associates are eligible for the firm's Employee Assistance Program. For more information on the Benefits available to Edward Jones associates, please visit our benefits page. 
 
Hiring Minimum: $101700 
Hiring Maximum: $173200 
 
Read More About Job Overview 
 
Skills/Requirements 
 
What Experience You'll Need: 
<ul><li>
5+ years of hands‑on penetration testing experience across web, API, and/or mobile applications.</li><li>
Strong subject matter expertise with mobile application development &amp; testing</li><li>
Strong ability to identify, exploit, and document vulnerabilities such as:<ul><li>
Authentication and authorization flaws</li><li>
Injection attacks</li><li>
Business logic issues</li><li>
API security weaknesses</li><li>
Client-side security issues</li><li>
Web Application Security</li></ul></li><li>
Proficiency with web technologies (HTTP/S, REST/GraphQL, cookies, sessions, CORS, JWT)</li></ul> 

Hands‑on experience with: 
<ul><li>
Web proxies (e.g., Kali Linux, Burp Suite Pro)</li><li>
Browser exploitation tools</li><li>
Mobile Application Security (iOS &amp; Android)</li><li>
Experience testing mobile applications, including:<ul><li>
Static and dynamic analysis</li><li>
Reverse engineering basics</li><li>
Mobile OS security models (sandboxing, keychain/keystore, app permissions)</li><li>
Common web attack techniques, OWASP Testing Methodology</li></ul></li></ul> 

Familiarity with: 
<ul><li>
Burp Suite Pro, Frida, MobSF</li><li>
Mobile runtime manipulation and SSL pinning bypass techniques</li><li>
Mobile API interaction and backend validation</li><li>
Comfort using Linux and command‑line tooling.</li><li>
Scripting experience (Python, Bash, or PowerShell).</li><li>
Ability to read and interpret code in languages such as Java, Kotlin, Swift, JavaScript, or C#.</li></ul> 

Current INTERNAL home-based associates: While this role is posted as hybrid, if selected and accepted, you may retain your home-based status. Edward Jones intends in good faith to continue offering the role as home-based, though future business or regulatory needs may require on-site work. 
 
**Candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office four days per week effective June 1, 2026. Before June 1, 2026, candidates that live within a commutable distance from our Tempe, AZ and St. Louis, MO home office locations are expected to work in the office three days per week, with preference for Tuesday through Thursday.**
 
 
Read More About Skills/Requirements 
 
Awards &amp; Accolades 
 
At Edward Jones, we are building a place where everyone feels like they belong. We're proud of our associates' contributions to the firm and the recognitions we have received. 
 
Check out our U.S. awards and accolades: Insights &amp; Information Blog Postings about Edward Jones 
 
Check out our Canadian awards and accolades: Insights &amp; Information Blog Postings about Edward Jones 
 
Read More About Awards &amp; Accolades 
 
About Us 
 
Join a financial services firm where your contributions are valued. Edward Jones is a Fortune 500&sup1; company where people come first. With over 9 million clients and 20,000 financial advisors across the U.S. and Canada, we're proud to be privately-owned, placing the focus on our clients rather than shareholder returns. 
 
Behind everything we do is our purpose: We partner for positive impact to improve the lives of our clients and colleagues, and together, better our communities and society. We are an innovative, flexible, and inclusive organization that attracts, develops, and inspires performance excellence and a sense of belonging.
 
 
People are at the center of our partnership. Edward Jones associates are seen, heard, respected, and supported. This is what we believe makes us the best place to start or build your career.
 
 
View our Purpose, Inclusion and Citizenship Report. 
 
&sup1;Fortune 500, published June 2024, data as of December 2023. Compensation provided for using, not obtaining, the rating. 
 
Edward Jones does not discriminate on the basis of race, color, gender, religion, national origin, age, disability, sexual orientation, pregnancy, veteran status, genetic information or any other basis prohibited by applicable law. 
 
#LI-HO</div>

Penetration Test Engineer IV

MUFG

<div>Do you want your voice heard and your actions to count?
Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the world&rsquo;s leading financial groups. Across the globe, we&rsquo;re 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building long-term relationships, serving society, and fostering shared and sustainable growth for a better world.
With a vision to be the world&rsquo;s most trusted financial group, it&rsquo;s part of our culture to put people first, listen to new and diverse ideas and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career.
Join MUFG, where being inspired is expected and making a meaningful impact is rewarded.
The selected colleague will work at an MUFG office or client sites four days per week and work remotely one day. A member of our recruitment team will provide more details.<div>
Job Summary</div><div><div><div><div><div><div><div><div><div>
Being part of the red team provides you with the opportunity to work on the cutting edge of cybersecurity and help drive the improvement of detection capabilities as well as strengthening of defenses to improve our overall security posture. The role also offers you with the opportunity to lead and mentor junior team members and provide guidance on complex projects.
Major Responsibilities
<ul><li>Developing guidelines for the usage, control, maintenance and audit-readiness of information and computer resources that are used in the distributed processing environment.</li><li>
Analyzing and addressing customer security requirements for all business applications existing on a distributed platform.</li><li>
Assisting in the evaluation, selection, and installation of security software products for distributed platforms.</li><li>
Identifying distributed systems security issues as they arise and coordinating with the security architect to ensure that issues are addressed and resolved in a timely basis.</li><li>
Conduct tactical assessments that require expertise in social engineering, application security (web and mobile), physical methods, lateral movement, threat analysis, internal and external network architecture and a wide array of products</li><li>
Document and formally report testing initiatives, along with remediation recommendations and validation</li><li>
Maintain tools and scripts used in penetration-testing and red team processes</li><li>
Conduct research into real-world threat actor tactics, techniques, and procedures (TTPs) and apply that knowledge to Red Team Exercises</li><li>
Assess new technologies, software applications, and devices for potential avenues of exploitation</li><li>
Develop exploits based on identified vulnerabilities</li><li>
Develop scripts, tools, or methodologies to enhance Red Team processes</li><li>
Work with teammates to consistently learn and share advanced skills and foster team excellence</li></ul>
Qualifications<ul><li>
Bachelor's Degree in Computer Science or related fields; applicable specialized training; or equivalent work experience - equally preferable</li><li>
Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), OSCP, OSCE, GWAPT, or other security certifications desired</li><li>
Understanding of one or more compliance frameworks: NIST, FFIEC, GLBA, SOX, PCI, etc.</li><li>
5-7 year of experience conducting penetration-testing/red team engagements</li><li>
Experience in planning and executing advanced attacks that evade network and endpoint security controls to demonstrate the potential adverse impact caused by a threat actor</li><li>
Experience with implementing red team assessment methods, tools, and techniques</li><li>
Experience identifying and exploiting common web-application vulnerabilities, such as: SQL Injection, DOM Manipulation, Authorization System Bypass, Design Logic issues, bounds checking, role &amp; access validation, and filter evasion.</li><li>
Experience handcrafting/dissecting HTTP conversations</li><li>
Experience in developing, extending, or modifying exploits and offensive security tools (shellcode, implants, reflective loaders, etc.), as well as operational experience exploitation, lateral movement, and persistence on Windows and Linux systems, bypassing preventative and detective endpoint and network security controls, C2 frameworks (Cobalt Strike and Metasploit), using common offensive security tools (nmap, CrackMapExec, Impacket, Responder, etc.)</li></ul>
The typical base pay range for this role is between $110K - $135K depending on job-related knowledge, skills, experience and location. This role may also be eligible for certain discretionary performance-based bonus and/or incentive compensation. Additionally, our Total Rewards program provides colleagues with a competitive benefits package (in accordance with the eligibility requirements and respective terms of each) that includes comprehensive health and wellness benefits, retirement plans, educational assistance and training programs, income replacement for qualified employees with disabilities, paid maternity and parental bonding leave, and paid vacation, sick days, and holidays. For more information on our Total Rewards package, please click the link below.
MUFG Benefits Summary</div></div></div></div></div></div></div></div></div>
We will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable state and local laws (including (i) the San Francisco Fair Chance Ordinance, (ii) the City of Los Angeles&rsquo; Fair Chance Initiative for Hiring Ordinance, (iii) the Los Angeles County Fair Chance Ordinance, and (iv) the California Fair Chance Act) to the extent that (a) an applicant is not subject to a statutory disqualification pursuant to Section 3(a)(39) of the Securities and Exchange Act of 1934 or Section 8a(2) or 8a(3) of the Commodity Exchange Act, and (b) they do not conflict with the background screening requirements of the Financial Industry Regulatory Authority (FINRA) and the National Futures Association (NFA). The major responsibilities listed above are the material job duties of this role for which the Company reasonably believes that criminal history may have a direct, adverse and negative relationship potentially resulting in the withdrawal of conditional offer of employment, if any.
The above statements are intended to describe the general nature and level of work being performed. They are not intended to be construed as an exhaustive list of all responsibilities duties and skills required of personnel so classified.
We are proud to be an Equal Opportunity Employer and committed to leveraging the diverse backgrounds, perspectives and experience of our workforce to create opportunities for our colleagues and our business. We do not discriminate on the basis of race, color, national origin, religion, gender expression, gender identity, sex, age, ancestry, marital status, protected veteran and military status, disability, medical condition, sexual orientation, genetic information, or any other status of an individual or that individual&rsquo;s associates or relatives that is protected under applicable federal, state, or local law.</div>

Red Team Operator, Assistant Vice President

DoorDash

<div><h2 class="jobSectionHeader">About the Team</h2>

At DoorDash we're building the industry's most scalable and reliable delivery network to support our three-sided marketplace of consumers, merchants, and Dashers. Security is paramount to the success of our business, and DoorDash Security aspires to be the world's best security team. We are committed to protecting our people, partners, customers, and technologies with robust safeguards and unwavering vigilance.
<h2 class="jobSectionHeader">
About the Role</h2>

The Senior Security Engineer, Red Team will be responsible for conducting threat intelligence-informed adversary emulations to simulate real-world cyber attacks and proactively identify security improvement opportunities in the DoorDash environment. This role will work closely with cross-functional teams across the company and assess the security posture of DoorDash's critical assets and products.

This role operates with the necessary freedom and accountability to complete full-scope Red Team operations against any valuable objectives in the company, providing a crucial feedback loop for all efforts in upholding customer trust.
<h2 class="jobSectionHeader">
You're excited about this opportunity because you will&hellip;</h2>
<ul><li>Plan and execute realistic adversary simulations using curated threat intelligence to assess security opportunities, and detection and response capabilities</li>
<li>Hunt for vulnerabilities across AI systems, payment infrastructure, autonomous delivery hardware, and emerging technologies before adversaries do</li>
<li>Exercise range of expertise to include cyber, insider, and fraud Red Team testing scenarios.</li>
<li>Build custom tools, exploits, and payloads tailored to DoorDash's unique and evolving tech stack</li>
<li>Partner with Blue Teams to escalate emerging threats and develop proactive detection or defensive strategies</li>
<li>Advise leadership on emerging threats and shape the security strategy for one of the world's most complex logistics platforms</li>
</ul><h2 class="jobSectionHeader">We're excited about you because&hellip;</h2>
<ul><li>5+ years of experience in Red Teaming and Purple Teaming</li>
<li>You are passionate about offensive security and care about improving your craft every day</li>
<li>You think like an adversary. You have deep, experiential knowledge of APT and insider threat TTPs, not just theoretical familiarity</li>
<li>Experience partnering with cross-functional teams to secure diverse environments, providing feedback loops that articulate business risks and generate actionable intelligence</li>
<li>You've run full-scope operations across multi-platform and cloud environments, and you know how to build the malware and tooling to support them</li>
<li>Strong knowledge of one of Python, Golang, Rust, Kotlin, Java, or Powershell</li>
<li>Experience using and developing tooling, methodologies and scalable infrastructure to support red team engagements capabilities (e.g. command and control frameworks, phishing environment, exploits)</li>
<li>Experience with Command and Control (C2) frameworks</li>
<li>Experience with Defense Evasion to bypass security tooling (e.g. Endpoint Detection and Response)</li>
<li>Excellent understanding of information security operations related frameworks and standards (e.g., MITRE Att&amp;ck)</li>
<li>Experience providing technical leadership and guidance, and thinking strategically and analytically to solve problems</li>
<li>Excellent communication, presentation, and stakeholder management skills</li>
<li>Engages with a people-first approach, is able to facilitate a conversation rather than dictate it, and is empathetic to divergent viewpoints</li></ul> 
 
We expect this position to be filled by 5/19/25.<div><h2 class="jobSectionHeader">
About DoorDash</h2>

At DoorDash, our mission to empower local economies shapes how our team members move quickly, learn, and reiterate in order to make impactful decisions that display empathy for our range of users&mdash;from Dashers to merchant partners to consumers. We are a technology and logistics company that started by enabling door-to-door delivery, and we are looking for team members who can help us go from a company that is known as the place you order food to a company that people turn to for any and all goods. 
 
DoorDash is growing rapidly and changing constantly, which gives our team members the opportunity to share their unique perspectives, solve new challenges, and own their careers. We're committed to supporting employees' happiness, healthiness, and overall well-being by providing comprehensive benefits and perks including premium healthcare, wellness expense reimbursement, paid parental leave and more.
<h2 class="jobSectionHeader">
Our Commitment to Diversity and Inclusion</h2>

We're committed to growing and empowering a more inclusive community within our company, industry, and cities. That's why we hire and cultivate diverse teams of people from all backgrounds, experiences, and perspectives. We believe that true innovation happens when everyone has room at the table and the tools, resources, and opportunity to excel.

Statement of Non-Discrimination: In keeping with our beliefs and goals, no employee or applicant will face discrimination or harassment based on: race, color, ancestry, national origin, religion, age, gender, marital/domestic partner status, sexual orientation, gender identity or expression, disability status, or veteran status. Above and beyond discrimination and harassment based on &quot;protected categories,&quot; we also strive to prevent other subtler forms of inappropriate behavior (i.e., stereotyping) from ever gaining a foothold in our office. Whether blatant or hidden, barriers to success have no place at DoorDash. We value a diverse workforce &ndash; people who identify as women, non-binary or gender non-conforming, LGBTQIA+, American Indian or Native Alaskan, Black or African American, Hispanic or Latinx, Native Hawaiian or Other Pacific Islander, differently-abled, caretakers and parents, and veterans are strongly encouraged to apply. Thank you to the Level Playing Field Institute for this statement of non-discrimination.

Pursuant to the San Francisco Fair Chance Ordinance, Los Angeles Fair Chance Initiative for Hiring Ordinance, and any other state or local hiring regulations, we will consider for employment any qualified applicant, including those with arrest and conviction records, in a manner consistent with the applicable regulation.

If you need any accommodations, please inform your recruiting contact upon initial connection.</div></div>

Senior Security Engineer, Red Team

Search 10000+ Offensive security engineer jobs near you this March. New roles added regularly across leading industries. Apply today.