Principal Offensive Security Engineer

Postman•San Francisco, CA

53d•$275,000 - $300,000•Onsite

About The Position

Postman is seeking a Principal Offensive Security Engineer to set the strategic direction of its offensive security program and build a dedicated Offensive AI Security capability. The role will shape the program over the next three years, establish Postman as a leader in adversarial testing of AI systems, agentic workflows, and LLM integrations, and partner with CISO leadership on threat-informed defense strategy. The engineer will lead a team that demonstrates vulnerabilities through live exploits and builds security awareness across engineering. The position combines strategic program ownership, hands-on technical leadership, people management, and executive communication. It includes defining a multi-year roadmap across red teaming, purple teaming, and continuous security validation; developing AI threat intelligence and methodologies; leading adversarial campaigns against AI systems; architecting autonomous testing and breach simulation; and ensuring findings improve detection, response, and architecture. The role also builds and develops the offensive security team, presents exploit demonstrations to engineering, and communicates risk to executives, the board, and external stakeholders. Postman’s Information Security organization works across Governance Risk & Compliance, Product Security, and Security Operations. Its security stack includes Wiz, SentinelOne, Okta, Jamf, and 1Password, and it operates in a multi-cloud environment. Postman maintains SOC 2 Type II, ISO 27001, ISO 42001, and HIPAA compliance postures and is pursuing FedRAMP High and CMMC Level 2 authorization. The role is based in person at one of Postman’s hubs. Hubs in San Francisco Bay Area, Boston, Austin, New York City, Tokyo, and London work in office five days a week. Bangalore roles currently work in office three days a week and are expected to transition to five days per week by year-end. The estimated base salary is $275,000–$300,000, plus a competitive equity package; actual compensation depends on skills, qualifications, and experience.

Requirements

At least 8 years of experience in offensive security, such as penetration testing, red teaming, vulnerability research, or exploit development.
At least 4 years in people management or leadership, including experience managing managers or technical leads.
Demonstrated experience attacking AI/ML systems through adversarial ML research, LLM red teaming, agentic system exploitation, or offensive tooling for AI targets.
Ability to build and scale an offensive security program from the ground up or significantly mature an existing program.
Experience setting OKRs, managing budgets, and presenting to executive leadership.
Deep understanding of the modern threat landscape and its application to cloud-native, API-first, and AI-native environments.
Hands-on experience with AI-augmented penetration-testing tools and AI red-team frameworks, and understanding of managing non-deterministic AI outputs in tools and target systems.
Ability to communicate complex exploit chains, including AI-specific attack paths, to developers in an effective and respectful way.
Engineering fluency, including ability to build automated exploit-as-code validators, evaluation harnesses, and adversarial test suites for ML models.

Nice To Haves

Contributions to the offensive security or AI security community, such as conference talks, tool releases, published research, CVEs, or participation in OWASP, MITRE, or similar working groups.
Hands-on offensive security certifications such as OSCP, OSCE, OSEP, GXPN, GPEN, CRTP, or equivalent.
AI/ML-specific credentials, such as GIAC GMAI.
Deep familiarity with AWS security primitives, cloud-native attack paths, and container or Kubernetes exploitation.
Experience with API attack methodologies such as BOLA, BFLA, mass assignment, GraphQL abuse, and gRPC exploitation.
Familiarity with mapping offensive security outputs to SOC 2 Type II, ISO 27001, ISO 42001, FedRAMP, or CMMC control evidence.

Responsibilities

Define and execute a multi-year offensive security roadmap aligned with Postman’s threat landscape and business priorities.
Build and scale an offensive AI security practice, including methodologies, tooling, and engagement frameworks for testing LLM integrations, agentic workflows, RAG pipelines, and model-serving infrastructure.
Track and operationalize AI threat intelligence, translating external research into internal red-team playbooks and detection hypotheses.
Lead adversarial campaigns against LLM deployments, AI agents, and model pipelines, including testing for prompt injection, tool-use abuse, data exfiltration, training data poisoning, model manipulation, and trust-boundary violations.
Design and deploy AI-based penetration-testing platforms and autonomous agents for continuous security validation across Postman’s API ecosystem.
Integrate automated breach and attack simulation into CI/CD pipelines, including AI model deployment pipelines.
Build, manage, and scale a high-performing offensive security team, including AI red-team specialists; provide mentorship, career development, and succession planning.
Recruit offensive security and AI/ML talent and develop internal pathways for security engineers to cross-skill into AI red teaming.
Lead live exploitable demonstrations that show engineering teams how vulnerabilities can be leveraged, including AI-specific attack vectors.
Translate offensive findings into business-level risk narratives for executive leadership, the board, and external stakeholders.
Partner with GRC on audit evidence and compliance posture derived from offensive operations, including AI-specific risk frameworks such as ISO 42001.
Collaborate across Product Security, Security Operations, and Engineering to ensure findings drive measurable improvements in detection, response, and architecture.