Manager, Red Team: Product Security Engineering

SailPoint

11d•$124,100 - $209,214

About The Position

You will build and lead a continuous adversarial testing program against SailPoint's next-generation Atlas Platform, using frontier AI as a force multiplier, not a novelty. A typical day: reviewing results from overnight autonomous testing campaigns, chaining minor vulnerabilities into high-impact proof-of-concept exploits, or handing validated attack playbooks to the CISO's Red Team. You won't write reports that sit in a queue. You will translate adversarial findings into secure design improvements that change how engineering builds software. This is a greenfield offensive security unit within Product Security Engineering, reporting to the Director of Engineering Product Security. The team exists to challenge and secure our identity governance systems, AI-powered product features, and core platform services through continuous adversarial validation, not annual pen tests.

Requirements

Proven offensive security operator who builds teams, not just finds bugs.
Led or built red team programs, not just executed engagements.
Knows how to hire offensive engineers, define scope, manage rules of engagement, and translate findings into engineering action.
Hands-on experience with AI-powered offensive tooling, agentic pen testing platforms, or autonomous exploit generation.
Understands the difference between a scanner with an AI label and a system that reasons about attack paths.
Finds vulnerabilities through semantic analysis, not pattern matching.
Reads code, reasons about exploitability, and builds proof-of-concept exploits across multiple languages.
Understands the vulnerability classes that matter for identity platforms: authentication flow weaknesses, authorization logic flaws, entitlement calculation errors, and tenant isolation failures.
Tested adversarial attacks against AI systems, prompt injection, goal redirection, RAG poisoning, model supply chain compromise, or agentic scope escape.
Knows OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF as applied to offensive testing.
Thinks in attack paths, not individual findings.
Instinct is to ask what a medium-severity issue enables when combined, not to file it and move on.
Writes exploitation narratives that a VP of Engineering reads and acts on.
Presents to executives without losing technical credibility.
Understands that a finding without a remediation path and a business impact statement is a finding that gets deprioritized.
Understands OAuth/OIDC/SAML weaknesses, entitlement edge cases, tenant isolation boundaries, privilege escalation through identity chaining.
5+ years of offensive security experience with at least 2 years in a team lead or management role.
Demonstrated experience with agentic or AI-powered offensive security tooling in a production program.
Hands-on proficiency in at least two of: application pen testing, source code security review, cloud security assessment, AI/LLM adversarial testing.
Experience operating in or building a red team program at a SaaS or platform company.
Strong written communication, you will produce exploitation chain documentation that drives executive decisions.
Bachelor's degree in a relevant field or equivalent experience.

Nice To Haves

Prior experience testing identity platforms or IAM products is strongly preferred.

Responsibilities

Build and lead a continuous adversarial testing program against SailPoint's next-generation Atlas Platform.
Review results from overnight autonomous testing campaigns.
Chain minor vulnerabilities into high-impact proof-of-concept exploits.
Hand validated attack playbooks to the CISO's Red Team.
Translate adversarial findings into secure design improvements that change how engineering builds software.
Challenge and secure identity governance systems, AI-powered product features, and core platform services through continuous adversarial validation.
Assess and Design: Complete a comprehensive review of the identity platform architecture, existing security practices, and current attack surface.
Outline the optimal Red Team structure and identify critical hires based on the program's mandate for agentic AI and continuous testing.
Deliver an initial strategic vision and program roadmap, clearly distinguishing this program from traditional penetration testing.
Build & Prepare: Open recruiting pipelines and begin actively sourcing, screening, and extending offers for initial Red Team members.
Draft rules of engagement in collaboration with Product Security and Engineering leadership.
Complete a preliminary attack surface map of the core identity platform, prioritizing AI product features and agentic orchestration layers.
Formalize the CISO Red Team partnership with a quarterly cadence for method transfer, tooling configurations, and attack playbooks.
Initialize & Execute: Formally define initial scope and target areas, prioritizing identity platform core and AI features.
Select, deploy, and configure at least one agentic offensive security platform for autonomous source code analysis or vulnerability chaining.
Plan and execute the first short-cycle adversarial campaign, establishing initial operational processes.
Stand up preliminary threat intelligence integration for identity platforms, SaaS infrastructure, and AI/ML attack techniques.
Scale & Formalize: At least 50% of target headcount onboarded and actively contributing to adversarial campaigns with demonstrated proficiency in agentic AI tooling.
Minimum three distinct continuous adversarial campaigns executed, including dedicated AI product feature testing, producing actionable findings.
Minimum two detailed exploitation narratives resulting in concrete secure design improvements or SSDLC changes by engineering teams.
CISO Red Team proving ground fully established, including at least one joint adversarial exercise completed.
Full Maturity & Impact: Full team operational capacity with agentic AI as a core capability, not a supplement.
Overnight autonomous campaigns running continuously, delivering prioritized findings daily at 3–5x coverage of team size.
Measurable reduction in high-severity vulnerabilities driven by Red Team findings feeding secure design improvements, threat model updates, and SSDLC enhancements.
Attack methodology continuously reflecting current real-world TTPs, APT campaigns targeting identity providers, supply chain compromise vectors, and emerging AI-specific attack techniques.

Benefits

Health and wellness coverage: Medical, dental, and vision insurance
Disability coverage: Short-term and long-term disability
Life protection: Life insurance and Accidental Death & Dismemberment (AD&D)
Additional life coverage options: Supplemental life insurance for employees, spouses, and children
Flexible spending accounts for health care, and dependent care; limited purpose flexible spending account
Financial security: 401(k) Savings and Investment Plan with company matching
Time off benefits: Flexible vacation policy
Holidays: 8 paid holidays annually
Sick leave
Parental support: Paid parental leave
Employee Assistance Program (EAP) and Care Counselors
Voluntary benefits: Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options
Health Savings Account (HSA) with employer contribution
SailPoint Corporate Bonus Plan or a role-specific commission
Potential eligibility for equity participation