Offensive Security Engineer

Responsible for proactively identifying, exploiting, and documenting security vulnerabilities across the organization's enterprise applications, infrastructure, and physical security controls.

• Identify technical weaknesses through active testing, logical analysis, and proactive detection.
• Penetration Testing:
  Perform comprehensive tests across infrastructure, networks, and applications.
• Minimum Toolset:
  Utilize industry-standard tools such as Burp Suite, Postman, and Kali Linux to identify and exploit vulnerabilities.
• Red Team Injection Logic:
  Plan and execute technical "injections" and simulated attack steps within larger red team exercises.
• Canary Administration:
  Manage and administer Canary tokens/devices to detect unauthorized presence or activity.
• Threat Hunting:
  Execute threat hunts designed by the Threat Intelligence team to proactively search for adversary activity.

• Follow strict internal standards that are continuously improved; each engagement follows established SOPs.
• Conduct project-based "test-and-report" engagements, performed in-house or via a vendor based on project classification.
• Participate in TTX Scope Exercises, including company-wide simulations and custom focused scenarios with internal teams.
• Support punctual red team activities, increasingly required for validating defensive controls.

The offensive team focuses on the technical application of intelligence, with access to TTPs and internal threat intelligence tooling. Threat hunting is a collaborative effort with the Threat Intelligence team; familiarity with their specific tooling is advantageous but not mandatory.

• Strong knowledge of Burp Suite and other attack tooling/frameworks.
• Proficiency in identifying the correct CWE, calculating CVSS scores, and applying OWASP Top 10 lists and attack patterns.

• Full lifecycle of security assessments and documentation: scope planning based on demo meetings/technical docs, executing tests per the scope document, and delivering findings to all organizational levels, including executive summaries.
• Table-Top Exercises (TTX): investigate technical documentation and playbooks to design attack patterns and injections; facilitation is not required.
• Threat Hunts: perform threat hunts supported by or in conjunction with the Threat Intelligence team/tooling.
• Documentation & Peer Review: produce high-quality technical documentation for all tests and perform peer reviews of reports from other penetration testers.