Offensive Security Engineer

Finix•San Francisco, CA

1d•$180,000 - $230,000•Onsite

About The Position

Finix is hiring an Offensive Security Engineer to identify weaknesses in its applications, cloud infrastructure, and corporate environment before attackers do, and to partner with engineers to remediate them. The role sits within the Engineering organization and works closely with Engineering, Information Security, Compliance, and IT. It is an in-office position based in Finix’s San Francisco office. The engineer will lead internal penetration testing, including PCI DSS penetration and segmentation testing for Finix’s cardholder data environment as a Level 1 service provider. The role also involves testing new features and architecture, reviewing Java source code, validating and retesting findings, improving detection through purple-team exercises, and building automation to scale security testing. The engineer will use frontier AI models and operate self-hosted models for security testing, keeping source code, findings, and sensitive data within Finix’s environment, and test internal AI tools and LLM integrations for security issues.

Requirements

At least 4 years of hands-on offensive security experience, such as penetration testing, red teaming, or application security testing.
Deep web application and API testing skills.
Experience attacking cloud environments, especially AWS.
Proficiency in Python or Go, ability to read and review Java code, and mastery of tools such as Burp Suite.
Hands-on experience using frontier AI models in offensive security work, such as AI-assisted code review, fuzzing, or automated testing agents.
Strong ability to explain findings and risk to engineers and non-technical stakeholders.
Sound judgment and respect for scope and rules of engagement when testing production-adjacent systems.

Nice To Haves

Published CVEs, security research, conference talks, or recognition in bug bounty programs.
CTF experience.
Kubernetes and container security testing, including EKS.
Mobile or Android application testing.
Active Directory, Okta, or identity provider attack techniques.
Familiarity with payment systems, such as card networks, HSMs, or ISO 8583.
LLM and AI application security testing.

Responsibilities

Plan and run red-team tests across web applications, APIs, AWS infrastructure, Kubernetes, and the corporate environment.
Perform PCI DSS penetration testing and segmentation testing for the cardholder data environment as a Level 1 service provider.
Test new features and architecture changes, and partner with Engineering on threat modeling and secure design.
Review source code, especially Java services, for security flaws and help engineers understand and fix them.
Run purple-team exercises with detection and incident response teams to validate and improve alerting.
Validate and reproduce bug bounty and third-party penetration-test findings, and assess their real-world impact.
Write clear reports with reproducible steps, business impact, and practical remediation guidance, and retest fixes.
Build tooling and automation to scale offensive testing and catch regressions.
Use frontier AI models to accelerate offensive testing, including AI-assisted workflows and agents for reconnaissance, code review, vulnerability discovery, and exploit validation.
Deploy and operate self-hosted AI models for security testing so source code, findings, and sensitive data stay inside Finix’s environment.
Test internal AI tooling and LLM integrations for prompt injection, data leakage, and abuse.