Principal Offensive Security Engineer

Alteryx • Irvine, CA

1d • $183,000 - $200,000

About The Position

Alteryx is seeking a Principal Offensive Security Engineer in the United States to serve as a senior technical leader within its Offensive Security program. The role leads risk-prioritized penetration testing, red-team engagements, and adversary simulations across product and enterprise environments. It is highly hands-on: the engineer scopes and executes complex engagements while setting technical direction, improving testing methods, and mentoring other practitioners.

A key focus is the practical use of artificial intelligence in offensive security. The engineer develops and evaluates AI-assisted workflows to improve offensive testing and operational effectiveness, and partners with Security Operations, Detection Engineering, Incident Response, Application Security, Cloud Security, IT, and Engineering to validate defensive controls and improve detection and response to realistic adversary behavior.

The position is based in the United States. The stated salary range is $183,000–$200,000. Employees may also be eligible for benefits such as a bonus or commission, medical, retirement, financial, wellness, time off, and employee discounts. The position involves access to technology subject to U.S. export controls; any offer is contingent on the applicant’s ability to serve in compliance with those controls.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent experience.
• At least 8 years of relevant information security experience, including significant hands-on experience in penetration testing, red teaming, adversary simulation, or offensive security.
• Demonstrated experience independently leading complex penetration tests or offensive security engagements.
• Deep hands-on expertise in one or more core domains—such as application/API exploitation, cloud offensive security, identity, or enterprise environments—and practical working knowledge across other domains, including the ability to chain weaknesses into realistic attack paths and assess business impact.
• Strong knowledge of attacker techniques across initial access, credential access, privilege escalation, persistence, lateral movement, defense evasion, and data access.
• Hands-on offensive security experience in at least one major cloud platform (GCP, AWS, or Azure) and modern identity environments, including technologies such as Active Directory, SAML, OAuth, OIDC, MFA, and SSO.
• Experience with modern offensive security tooling and frameworks across web, identity, network, and adversary-emulation testing.
• Ability to develop or modify offensive security tooling using languages such as Python, PowerShell, Bash, Go, or similar.
• Hands-on experience incorporating AI into offensive security or red-team operations, with concrete examples of workflows or tools developed or adapted, how results were validated, and operational benefits achieved.
• Experience planning or leading purple-team exercises and translating offensive findings into defensive improvements.
• Strong understanding of MITRE ATT&CK and ability to map offensive activity to adversary techniques and defensive coverage.
• Excellent written and verbal communication skills, including communicating technical risk to engineering teams, security leadership, and executives.
• Demonstrated experience mentoring offensive security engineers, setting technical direction, and influencing outcomes across engineering and security teams.

Nice To Haves

• Contributions to the offensive security or AI security community through conference presentations, open-source tooling, published research, vulnerability disclosures, or participation in industry working groups.
• Experience building or maturing an internal red-team or offensive security program.
• Experience conducting advanced adversary-emulation or assumed-breach exercises.
• Experience building AI integrations using agent frameworks, LLM APIs, or local or hosted models.
• Experience assessing AI-enabled applications, LLM-integrated systems, or agentic workflows.
• Additional depth in SaaS security, endpoint/EDR evasion, exploit development, or social engineering.
• Experience designing repeatable purple-team validation programs.
• Strong hands-on offensive security experience in GCP; experience assessing Kubernetes environments is also preferred.
• Relevant practical offensive security certifications such as OSCP, OSEP, OSWE, OSED, CRTO, GXPN, or comparable certifications.

Responsibilities

• Lead risk-prioritized penetration testing and offensive security assessments across products, web applications, APIs, infrastructure, cloud, identity, SaaS, and enterprise technologies.
• Identify, validate, and safely exploit vulnerabilities, demonstrating how weaknesses can be chained into realistic attack paths.
• Scope, design, and execute red-team campaigns and adversary simulations based on relevant threats, emerging techniques, and business risk.
• Develop, validate, and incorporate AI-assisted workflows into offensive security activities, including reconnaissance, campaign development, social engineering, tooling, and analysis.
• Develop custom scripts, tooling, payloads, and automation to support offensive security engagements.
• Conduct assessments primarily focused on GCP and modern identity platforms, with testing of AWS, Azure, and Kubernetes as relevant.
• Partner with SOC, Detection Engineering, Threat Hunting, and Incident Response teams to plan and execute purple-team exercises validating telemetry, detections, investigation workflows, and response capabilities.
• Partner with engineering and defensive teams to prioritize remediation, retest fixes, and verify improvements to detections, logging, monitoring, playbooks, and defensive controls.
• Document findings, attack paths, business impact, and recommended remediation, and communicate results to technical and executive audiences.
• Own the technical direction and execution of the offensive security roadmap in partnership with security leadership.
• Mature testing methodologies and provide hands-on mentorship and technical pairing to other offensive security practitioners.
• Measure program effectiveness through verified remediation, reduced exposure to critical attack paths, and repeatable validation of detection and response coverage.

Benefits

• Employees may be eligible for a bonus or commission, medical, retirement, financial, wellness, time off, and employee discounts.
• Alteryx states that benefits for associates are available to view on its benefits page.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal