Security Engineer II (Offensive Operations)

Flywire • Boston, MA

4d

About The Position

As a Security Engineer II on Flywire’s Active Operational Offensive track, you will help strengthen the company’s security defenses under the guidance of senior engineers. The role bridges manual penetration testing with active security operations, building the technical depth to lead independent engagements over time. You will test cloud infrastructure, web applications, APIs, and source code; collaborate with Blue Team and engineering partners; and provide actionable remediation guidance. The position also contributes to adversarial simulations, bug bounty operations, and threat-informed testing.

Requirements

• Bachelor of Science degree.
• At least 2 years of experience in IT security and penetration testing.
• Demonstrated experience executing network, web application, and API penetration tests.
• Proficiency with Kali Linux and commercial or open-source penetration-testing tools; active involvement on bug bounty platforms.
• Experience with SAST/DAST tools and secure code reviews.
• Scripting knowledge in Python, Java, or Ruby.
• Understanding of AWS cloud infrastructure, Agile environments, CI/CD pipelines, and Infrastructure as Code.
• Strong knowledge of OWASP methodologies, threat vectors such as malware, intrusion, and DoS, and platform security strategies.
• Ability to write technical reports and explain complex exploit chains to non-technical stakeholders.
• Analytical and calm under pressure, including during live security breaches or tight release windows.
• Ability to balance risk mitigation with organizational growth.

Nice To Haves

• OSCP, OSCE, or SANS GXPN certification.
• OffSec OSAI (Offensive Security AI Red Teamer) certification.
• Ability to combine offensive testing with defensive discipline in building actionable SIEM detection rules.

Responsibilities

• Execute manual internal and external penetration tests across AWS and multicloud environments to identify vulnerabilities, misconfigurations, and privilege-escalation paths.
• Assess web applications and REST/GraphQL APIs for business logic flaws, authentication bypasses, and OWASP Top 10 risks.
• Review SAST/DAST findings and conduct targeted code audits in Python, Java, and Ruby to eliminate false positives and prioritize high-risk fixes.
• Partner with the Blue Team in adversary emulation exercises to validate security controls, refine SIEM detection rules, and improve real-time alerting.
• Participate in goal-oriented red team simulations evaluating physical and digital security posture and incident-response readiness.
• Manage external vulnerability disclosure and bug bounty programs, including triaging submissions, validating severity, and coordinating engineering fixes.
• Apply emerging threat actor tactics, techniques, and procedures to align testing methodologies with the MITRE ATT&CK framework.
• Provide actionable remediation guidance to Engineering, SRE, and IT teams while balancing security and business velocity.

Benefits

• Competitive compensation.
• Employee Stock Purchase Plan (ESPP).
• Competitive time off.
• Wellbeing programs, including mental health, wellness, and Yoga/Pilates/HIIT classes.
• Talent and development programs, including Managers Taking Flight and OneFlywire Career Mobility.
• Opportunity to work with colleagues globally and contribute meaningfully to the company’s success.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level