Senior Attack Engineer, External

Horizon3

1d•$206,278 - $242,680•Remote

About The Position

Horizon3 is hiring a Senior Attack Engineer to drive key workstreams in the external attack capabilities of NodeZero, its autonomous pentesting platform. The role focuses on transforming manual reconnaissance and multi-step attack techniques into safe, reliable, repeatable workflows that run autonomously across very large external attack surfaces. This is an engineering and research role, not consulting or manual pentesting. The engineer will independently develop complex workstreams, contribute to the research and content roadmap, build expertise relied on by the team, and help raise engineering standards. Work includes discovering and analyzing external-facing assets and services; making messy and unstructured data actionable; modeling identities, privileges, and relationships; automating end-to-end attack paths; and validating techniques in representative test environments. The role emphasizes production safety, scalability, and respect for customer environments, scope, and rate limits. Horizon3 is a fully remote cybersecurity company. The position may require up to 5% travel. The stated annual base salary range is $206,278–$242,680, with the exact amount depending on location, qualifications, experience, and skills. Full-time roles are eligible for stock options. The company also lists health, vision, and dental insurance, a flexible vacation policy, and generous parental leave.

Requirements

Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation.
At least 5 years of hands-on experience in offensive security, security research, and/or security-focused software engineering, with recent work building and shipping offensive tooling.
Demonstrated experience building reconnaissance and discovery systems that run at scale, rather than only one-off scripts.
Strong ability to research and parse large volumes of messy, unstructured external data and turn it into usable, trustworthy information.
Experience collecting, storing, and connecting high volumes of data and reasoning about relationships such as identities, assets, and trust.
Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and movement among identities, tenants, and services.
Experience automating multi-step attack workflows end to end.
Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code.
Ability to independently research unfamiliar systems and technologies and rapidly build deep, practical expertise.
Strong written and verbal communication skills, including clear technical documentation.
Passion for building products, not just finding vulnerabilities.

Nice To Haves

OSCP, OSEP, CRTO, or equivalent offensive certifications.
Experience with large-scale internet data sources and tooling, such as certificate transparency, passive DNS, and internet-wide scanning.
Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, AWS, and on-premises-to-cloud pivots.
Experience with external-to-internal pivoting and how perimeter footholds lead to additional access.
Experience with graph databases and attack-path analysis, and with data lakes or high-volume data storage and processing.
Experience developing or contributing to offensive or reconnaissance tooling.
Public contributions to the field, such as open-source tools, technical blog posts, conference talks, or published CVEs.
Experience building production-safe autonomous or automated offensive tooling.

Responsibilities

Design, build, and maintain scalable reconnaissance workflows to discover, enumerate, and fingerprint external-facing assets and services using production-grade Python.
Research and parse large volumes of external-facing data, including unstructured and inconsistent sources, and turn it into accurate, actionable information.
Develop methods to interpret difficult data such as free-form banners, web content, documents, and error output, and build robust parsing and enrichment.
Collect, store, and connect high volumes of information, and extend attack-path modeling and the graph data model to represent identity, privilege, and relationship paths.
Traverse identity relationships across accounts, tenants, SSO and federation, exposed credentials, and third-party services to identify paths from exposure to compromise.
Automate multi-step attack workflows that chain discovery, credential access, initial access, and post-exploitation into safely proven attack paths.
Research emerging external tradecraft and turn it into production attack content, emphasizing techniques that succeed against hardened, well-monitored targets.
Stand up and maintain representative test environments to validate, demonstrate, and regression-test attack scenarios.
Build workflows for production safety and scale while respecting target and customer environments, rate limits, and scope.
Contribute to priorities and the coverage roadmap based on customer environments, threat intelligence, and emerging techniques.
Mentor teammates, support their growth, and help define team standards for code quality, research rigor, and operational safety.
Collaborate with engineers, product managers, and customer-facing teams, and author internal documentation, external research, and blog posts.