Principal Offensive Security Engineer

Alteryx • Irvine, CA

2d • $183,000 - $200,000

About The Position

Alteryx is hiring a Principal Offensive Security Engineer in the United States to serve as a senior technical leader in its Offensive Security program. The role leads risk-prioritized penetration testing, red-team engagements, and adversary simulations across product and enterprise environments. It is highly hands-on: the engineer scopes and executes complex engagements, sets technical direction, improves testing methods, and mentors other practitioners.

A key focus is developing and evaluating practical AI-assisted workflows to improve offensive testing and operational effectiveness. The engineer partners with Security Operations, Detection Engineering, Incident Response, Application Security, Cloud Security, IT, and Engineering to validate defensive controls and improve the organization’s ability to detect and respond to realistic adversary behavior. The position has a primary focus on GCP and modern identity platforms, with testing extending to other cloud and enterprise technologies as relevant.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent experience.
• 8+ years of relevant information security experience, including significant hands-on experience in penetration testing, red teaming, adversary simulation, or offensive security.
• Demonstrated experience independently leading complex penetration tests or offensive security engagements.
• Deep hands-on expertise in one or more core domains, such as application/API exploitation, cloud offensive security, identity, or enterprise environments, with practical working knowledge across other domains and the ability to chain weaknesses into realistic attack paths and assess business impact.
• Strong knowledge of attacker techniques across initial access, credential access, privilege escalation, persistence, lateral movement, defense evasion, and data access.
• Hands-on offensive security experience in at least one major cloud platform (GCP, AWS, or Azure) and modern identity environments, including technologies such as Active Directory, SAML, OAuth, OIDC, MFA, and SSO.
• Experience with modern offensive security tooling and frameworks across web, identity, network, and adversary-emulation testing.
• Ability to develop or modify offensive security tooling using languages such as Python, PowerShell, Bash, Go, or similar.
• Demonstrated hands-on experience incorporating AI into offensive security or red-team operations, with concrete examples of workflows or tools developed or adapted, how results were validated, and operational benefits achieved.
• Demonstrated experience planning or leading purple-team exercises and translating offensive findings into defensive improvements.
• Strong understanding of MITRE ATT&CK and ability to map offensive activity to adversary techniques and defensive coverage.
• Excellent written and verbal communication skills, including communicating technical risk to engineering teams, security leadership, and executives.
• Demonstrated experience mentoring offensive security engineers, setting technical direction, and influencing outcomes across engineering and security teams.

Nice To Haves

• Contributions to the offensive security or AI security community through conference presentations, open-source tooling, published research, vulnerability disclosures, or participation in industry working groups.
• Experience building or maturing an internal red-team or offensive security program.
• Experience conducting advanced adversary-emulation or assumed-breach exercises.
• Experience building AI integrations using agent frameworks, LLM APIs, or local or hosted models.
• Experience assessing AI-enabled applications, LLM-integrated systems, or agentic workflows.
• Additional depth in SaaS security, endpoint/EDR evasion, exploit development, or social engineering.
• Experience designing repeatable purple-team validation programs.
• Strong hands-on offensive security experience in GCP; experience assessing Kubernetes environments is also preferred.
• Relevant practical offensive security certifications such as OSCP, OSEP, OSWE, OSED, CRTO, GXPN, or comparable certifications.

Responsibilities

• Lead risk-prioritized penetration testing and offensive security assessments across products, web applications, APIs, infrastructure, cloud, identity, SaaS, and enterprise technologies.
• Identify, validate, and safely exploit vulnerabilities, demonstrating how weaknesses can be chained into realistic attack paths.
• Scope, design, and execute red-team campaigns and adversary simulations based on relevant threats, emerging techniques, and business risk.
• Develop, validate, and incorporate AI-assisted workflows into offensive security activities, including reconnaissance, campaign development, social engineering, tooling, and analysis.
• Develop custom scripts, tooling, payloads, and automation to support offensive security engagements.
• Conduct offensive security and red-team assessments primarily focused on GCP and modern identity platforms, extending testing to AWS, Azure, and Kubernetes as relevant.
• Partner with SOC, Detection Engineering, Threat Hunting, and Incident Response teams to plan and execute purple-team exercises that validate telemetry, detections, investigation workflows, and response capabilities.
• Partner with engineering and defensive teams to prioritize remediation, retest fixes, and verify improvements to detections, logging, monitoring, playbooks, and defensive controls.
• Document findings, attack paths, business impact, and recommended remediation, and communicate results to technical and executive audiences.
• Own the technical direction and execution of the offensive security roadmap in partnership with security leadership.
• Mature testing methodologies and provide hands-on mentorship and technical pairing to other offensive security practitioners.
• Measure program effectiveness through verified remediation, reduced exposure to critical attack paths, and repeatable validation of detection and response coverage.

Benefits

• Employees may be eligible for a bonus or commission, medical, retirement, financial, wellness, time off, and employee discounts.
• Alteryx states that it offers benefits and perks to all associates; details are available through its benefits information.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal