Senior Offensive Security Engineer

Position Overview FocusKPI is seeking a Senior Offensive Security Engineer (Web & AI systems) to join one of our high‑tech SaaS clients. The team proactively identifies, exploits, and eliminates security weaknesses across web platforms and AI/ML systems. The engineer will think like an attacker, operate with engineering rigor, and collaborate with product, platform, and AI teams to raise the security bar organization‑wide. This role leads complex penetration tests, designs novel attack techniques for web and modern AI‑powered applications, and influences secure‑by‑design architecture at scale. Work Location Mountain View, CA (Onsite role, 5 days/week onsite) Duration 12‑month contract with potential to convert depending on performance. Pay Range $60+/hr Recruitment Policy No C2C resumes are considered. Position Responsibilities Conduct offensive security assessments on large‑scale web applications, REST APIs, and cloud‑backed services. Identify and validate vulnerabilities, including injection flaws, access control issues, authentication/authorization weaknesses, SSRF, deserialization, and logic bugs. Evaluate LLM‑based systems and AI agents for prompt injection, data exfiltration, model abuse, and jailbreaks. Design and execute red‑team‑style engagements that simulate real‑world adversaries. Develop custom exploitation tools, PoCs, and fuzzers for web and AI attack surfaces. Identify systemic security weaknesses and collaborate with engineering teams to drive long‑term mitigations. Review architectures and designs for new products from an attacker's perspective. Produce clear, actionable security reports and present findings to technical and executive stakeholders. Required Qualifications Master’s degree in Computer Science, Computer Engineering, Information Security, or a closely related technical field. Doctorate (PhD) in a relevant field is a plus but not required. 5+ years of experience in offensive security, penetration testing, or red teaming. Experience with browser security, red teaming, and penetration testing is a non‑negotiable skill. Deep expertise in web application security. Strong understanding of API security. Experience identifying and prioritizing vulnerability findings across a network of 1,000+ devices and conducting regular assessments. Proficiency in at least one scripting or programming language (Python, Go, JavaScript, or similar). Strong knowledge of common exploitation techniques and attacker tooling. Preferred Qualifications Prior work on adversarial ML, red‑teaming AI systems, or secure LLM pipeline design. Experience with cloud security (AWS, GCP, Azure) and containerized environments. Hands‑on experience testing AI/ML or LLM‑based systems, or strong motivation with demonstrated research in this area. Background in security research, published CVEs, CTF experience, blog posts, or conference talks. Certification such as OSCP, OSEP, OSWE, CRTO, or similar. What the Team is Looking For An attacker‑first mindset with strong engineering discipline. Ability to go beyond scanners and find novel, high‑impact vulnerabilities. A clear communicator who can translate complex exploits into actionable fixes. Curiosity about emerging threats, especially in AI security. Ownership mentality and comfort operating in ambiguous problem spaces. #J-18808-Ljbffr