Engineering Manager, Internal Attack

Horizon3

1d•$238,000 - $280,000•Remote

About The Position

Horizon3 is hiring an Engineering Manager to lead the team responsible for innovating on and maintaining NodeZero’s core internal attack capabilities. The team researches modern internal attack tradecraft and turns often-manual techniques into production-safe, reliable, repeatable attacks that operate autonomously across large enterprise networks. Its coverage includes Active Directory, Linux and Unix hosts, databases, network infrastructure, and other services commonly found inside enterprise networks. This is a hands-on technical leadership role requiring credibility in design and code reviews, sound judgment about production safety, and the ability to explain attack paths to engineers, product managers, and customers. The role is focused on building software, not consulting or manual pentesting. The Engineering Manager will build and develop the team, set its direction and roadmap, oversee hiring and performance management, and ensure its work aligns with Product and Engineering goals. The manager will guide internal attack coverage, discovery capabilities, backend work on NodeZero’s attack-path graph and data model, engineering quality and safety standards, and delivery. They will partner with Product, peer Attack Engineering teams, and other engineering groups, and will own the team’s customer issue escalation and on-call rotation. The role may require up to 10% travel. Horizon3 is a fully remote company; the company also describes hybrid and remote work models depending on role and location.

Requirements

At least 2 years of experience managing engineers on an offensive security, red team, or attack engineering team, including hiring, performance management, and career development.
At least 8 years of combined offensive security and software engineering experience, including significant hands-on experience attacking Active Directory and internal enterprise networks.
Working command of current Active Directory tradecraft, including Kerberos attacks and delegation, NTLM coercion and relay, Active Directory Certificate Services abuse, ACL and GPO abuse, and lateral movement, including how techniques change in hardened environments.
Hands-on experience with internal attacks beyond Active Directory, including Linux and Unix privilege escalation and lateral movement, database exploitation, and attacks on network services and devices.
Software engineering fluency, including comfort reading and reviewing production Python and working with Git, merge requests, CI/CD, and product development workflows.
Experience turning offensive findings or manual techniques into product capabilities, automated tooling, or repeatable services.
Sound judgment about operational safety when running offensive techniques against production customer environments.
A record of building teams people want to join and stay on, setting clear expectations, giving direct feedback, and helping engineers grow.
Strong written and verbal communication with engineers, product partners, executives, and customers.
Comfort setting direction in ambiguous situations without a fully defined roadmap.

Nice To Haves

Experience leading teams that build autonomous pentesting, breach and attack simulation, or other offensive security products.
Experience with SCCM, Windows Admin Center, and hybrid identity attacks, including Entra Connect, primary refresh tokens, and seamless SSO.
Experience scaling network discovery and scanning tools such as nmap, masscan, and nuclei across very large enterprise networks.
Experience building LLM-powered agents or applying AI to offensive security or asset discovery workflows.
Familiarity with graph databases such as Neo4j and attack-path analysis.
OSCP, OSEP, CRTO, or equivalent offensive certifications.
Public contributions to the field, such as open-source tools, technical blog posts, conference talks, or published CVEs.
Experience managing a fully remote engineering team.

Responsibilities

Lead, coach, and grow a team of Attack Engineers and backend engineers focused on internal network attacks.
Own team hiring, including defining roles, running interview loops, and closing candidates.
Set expectations by level, provide feedback, conduct 1:1s and performance reviews, and create career growth plans.
Develop Staff and Principal engineers so technical expertise and review ownership are shared across the team.
Be accountable for team performance, work quality, and alignment with Product and Engineering goals.
Define strategy and roadmap for internal and Active Directory attack coverage, based on department goals, customer environments, and emerging tradecraft.
Guide attack coverage for modern hardened environments and across Active Directory, Linux and Unix, databases, network infrastructure, and embedded devices.
Own the discovery foundation for the attack chain, including host discovery, service and OS fingerprinting, and credential and secrets discovery at enterprise scale.
Encourage development of AI agents where they improve NodeZero’s internal attack capabilities.
Define and uphold production-safety standards, including account lockout safety, customer account exclusions, safe handling of fragile devices and production databases, artifact cleanup, and safe defaults for actions that change customer systems.
Set standards for code review, testing, lab-based regression testing, and observability.
Plan and deliver roadmap work, balancing new coverage, reliability fixes, and customer escalations.
Partner with Product to prioritize roadmap input from customer feedback, field findings, and threat intelligence.
Direct backend work on NodeZero’s attack-path graph and data model, coordinating required changes with Data Platform, Infrastructure, and other engineering teams.
Partner with peer Attack Engineering teams on shared infrastructure, cross-domain attack paths, and consistent engineering standards.
Own the team’s on-call rotation and act as the escalation point for internal-attack customer issues; lead triage and root cause analysis, turn recurring issues into durable fixes, and communicate exploitability, impact, and remediation.
Support customer briefings, go-to-market enablement, and external research such as blog posts and conference talks.