Senior Security Engineer, Offensive Security

Responsibilities

• Plan and execute internal penetration tests across applications, APIs, cloud infrastructure, and corporate systems, prioritizing work by risk and business impact.
• Define testing scope and rules of engagement, assess production risk, and select safe vulnerability-validation methods.
• Combine hands-on testing with source-code review and architectural analysis to identify vulnerabilities and demonstrate realistic attack paths.
• Partner with engineering teams through findings, remediation, and retesting, and maintain knowledge of Liftoff’s systems and attack surface.
• Build reusable security testing tools, automated testing workflows, self-service assessments, and remediation-validation processes.
• Support annual third-party penetration testing and coordinate findings through remediation.
• Evaluate and implement AI-assisted offensive security workflows for code analysis, test generation, and finding triage.
• Partner with Detection & Response on detection improvements and incident-response exercises.
• Participate in the security team’s on-call and incident-response rotation, including occasional off-hours response and post-incident follow-up.

Requirements

• 5+ years of relevant security engineering experience, including substantial hands-on penetration testing of applications and infrastructure.
• Experience independently owning assessments from planning through remediation and retesting, while safely validating vulnerabilities and assessing production impact.
• Ability to write production-quality code for security tools and automation, review pull requests, navigate large codebases, and validate proof-of-concept and AI-generated code.
• Strong understanding of application and API security, authentication and authorization, network security, and common vulnerability classes.
• Hands-on experience assessing cloud and infrastructure security, including identity and access controls, configuration, and attack paths.
• Ability to understand complex systems and architectures and contribute across application, cloud, and infrastructure security.
• Familiarity with testing, observability, version control, peer code review, continuous integration, and blameless postmortems.
• Strong technical writing and communication skills for assessment plans, findings, runbooks, post-incident reviews, exploitability, and business impact.
• Willingness to participate in on-call and incident-response responsibilities, including occasional off-hours response.
• Preferred experience with Go, Python, Clojure, or JavaScript.
• Preferred experience building AI-assisted security testing workflows and measuring their accuracy and usefulness.
• Preferred experience securing large-scale cloud systems, mobile advertising, or high-volume SaaS environments.

Benefits

• Benefits may include medical coverage, wellness stipends, equity, and additional perks based on country of residence.
• Liftoff describes a fast-paced, collaborative, and innovative work environment with opportunities to grow and make an impact.