Security Engineer, Red Team

Whatnot•San Francisco, CA

2d•$210,000 - $290,000•Remote

About The Position

Whatnot is hiring a Red Team Engineer to identify weaknesses in its infrastructure before real attackers do. The role uses AI tools and agents to scale offensive testing, builds the harnesses that run those tests, and turns findings into fixes across cloud, network, application, identity, and CI/CD layers. The position works collaboratively with Whatnot’s Blue Team on Purple Team engagements to strengthen the company’s security posture.

Requirements

At least 3 years of experience in offensive security, red teaming, or penetration testing, including real engagements against production-scale environments.
Strong Python programming skills and the ability to write original tooling.
Hands-on experience building LLM-powered workflows or agents, including tool use, orchestration, evaluation, and guardrails.
Deep knowledge of at least two of the following: cloud security and IAM abuse; Active Directory or identity attacks; Kubernetes and container escapes; web and API exploitation; CI/CD and supply-chain attacks.
Working knowledge of AI-specific risks, including prompt injection, insecure tool use, data leakage, excessive agent permissions, and model supply-chain issues.
Sound judgment about scope, safety, and blast radius, including how to test production-adjacent systems without causing outages.
Clear written communication, including reports that engineers can act on and executives can skim.

Responsibilities

Plan and run authorized red team operations across AWS, Kubernetes, networks, identity systems, SaaS, and internal applications under written rules of engagement.
Build and maintain AI-assisted testing harnesses, including agent loops for reconnaissance, attack-path discovery, fuzzing, and exploit validation, with logging, scope controls, and human approval gates.
Use LLMs and agentic tools for vulnerability research, payload and test-case generation, code review, and report drafting, and measure their effectiveness and limitations.
Test Whatnot’s AI systems for prompt injection, tool and connector abuse, data exfiltration, model and agent permission boundaries, and AI dependency supply-chain risks.
Emulate realistic adversaries using MITRE ATT&CK and ATLAS, chaining findings into end-to-end attack paths.
Run Purple Team exercises with detection engineering and incident response, and tune detections based on tests that evade them.
Write findings with reproduction steps, impact, and recommended fixes; track remediation through closure and retest.
Automate regression tests to help ensure fixed weaknesses stay fixed, and feed results into CI/CD pipelines.
Document and share techniques, tooling, and lessons learned with engineering teams.
Collaborate with Whatnot’s Blue Team on Purple Team engagements.

Benefits

Generous holiday and time-off policy.
Health insurance options, including medical, dental, and vision.
Work-from-home support.
Home office setup allowance.
Monthly cell phone and internet allowance.
Care benefits.
Monthly wellness allowance.
Annual childcare allowance.
Lifetime family-planning benefit, including adoption or fertility expenses.
US 401(k) with Traditional and Roth accounts and employer match up to 4% of base salary; pension plans internationally.
Monthly allowance to use Whatnot as a buyer and seller.
16 weeks of paid parental leave plus a one-month gradual return to work; company leave allowances run concurrently with country leave requirements, which take precedence.