Staff Offensive Security Engineer

Job Description

Staff Offensive Security Engineer — Red Team

\n

\n

About the Opportunity

\n

\n

Eden Prescott is partnering with one of our top FinTech clients (a16z backed) to hire a Staff Offensive Security Engineer to join its Red Team.

\n

\n

This is a highly technical, hands-on role for an experienced offensive security practitioner who can think and operate like a real-world adversary. You’ll be responsible for identifying meaningful security weaknesses across web applications, mobile applications, cloud infrastructure, identity systems, and corporate environments, then partnering with engineering and security teams to improve defenses.

\n

\n

We’re specifically looking for someone with deep experience conducting both web and mobile application red team assessments. This is a core requirement for the role.

\n

\n

You’ll operate at Staff level, owning complex offensive security engagements, helping shape red team strategy, mentoring other engineers, and communicating technical risk effectively from individual engineers through executive leadership.

\n

\n

What You’ll Do

\n

\n
• Plan and execute sophisticated red team exercises that simulate realistic adversary behavior and attack paths.
\n
• Conduct advanced penetration testing and offensive security assessments across web applications, mobile applications (iOS/Android), APIs, cloud infrastructure, identity systems, and corporate environments.
\n
• Identify and exploit vulnerabilities across modern application architectures and demonstrate realistic business impact.
\n
• Test authentication, authorization, session management, access controls, APIs, and other critical application security boundaries.
\n
• Conduct adversarial simulations alongside detection, incident response, and security engineering teams.
\n
• Evaluate and bypass defensive technologies including EDR, AV, IDS/IPS, and other detection controls.
\n
• Develop scripts, tooling, and automation to improve offensive security capabilities and testing efficiency.
\n
• Perform threat modeling against new technologies, architectures, and business processes.
\n
• Partner directly with engineering teams to understand vulnerabilities, prioritize risk, and drive effective remediation.
\n
• Communicate offensive security findings clearly to audiences ranging from deeply technical engineers to senior executives.
\n
• Support or lead security incidents originating from penetration testing or red team findings.
\n
• Mentor other offensive security engineers and help raise the technical bar across the team.
\n
• Research emerging attack techniques and develop testing methodologies for new technologies and attack surfaces.
\n

\n

\n

What You Bring

\n

\n
• 5+ years of experience in offensive security, red teaming, advanced penetration testing, or closely related security disciplines.
\n
• Demonstrated hands-on experience red teaming and penetration testing modern web applications.
\n
• Demonstrated hands-on experience conducting mobile application security assessments across iOS and/or Android environments.
\n
• Strong understanding of modern web and mobile attack surfaces, including authentication, authorization, APIs, business logic, client-side security, and application architecture.
\n
• Experience designing and executing realistic, multi-stage attack scenarios rather than relying solely on automated vulnerability scanning.
\n
• Deep understanding of common network protocols and technologies including DNS and TCP/IP.
\n
• Strong experience operating in macOS and Linux environments.
\n
• Experience attacking modern software development and infrastructure environments, including CI/CD pipelines, Kubernetes, Docker, AWS and/or GCP.
\n
• Knowledge of defensive security technologies and techniques including EDR, IDS/IPS, packet capture, network analysis, endpoint security, and methods used to evade or bypass them.
\n
• Deep understanding of the MITRE ATT&CK framework and how adversary techniques map to real-world offensive operations.
\n
• Strong knowledge of identity, authentication, authorization, and access-control security fundamentals.
\n
• Ability to read and write code in languages such as Python, Go, and JavaScript.
\n
• Ability to independently research unfamiliar technologies, develop an offensive testing methodology, and execute against it.
\n
• Strong written and verbal communication skills with the ability to translate technical vulnerabilities into clear business risk.
\n
• A remediation-focused mindset — you care about helping teams fix vulnerabilities, not simply finding them.
\n
• Experience mentoring or developing other security engineers.
\n
• Ability to operate effectively within distributed, highly collaborative engineering teams.
\n
• Strong written communication across tools such as Slack, Jira, GitHub, and email.
\n

\n

\n

What We’re Looking For

\n

\n

The strongest candidates are offensive security engineers who are naturally curious and persistent. You enjoy understanding how systems work, challenging assumptions, chaining seemingly minor weaknesses into meaningful attack paths, and approaching environments from the perspective of a sophisticated adversary.

\n

\n

Compensation

\n

Base Salary + significant equity + benefits