Senior Attack Engineer, Internal Systems

Horizon3

1d•$206,278 - $242,680•Remote

About The Position

Horizon3.ai is seeking a Senior Attack Engineer to lead complex internal network and Active Directory attack projects for NodeZero, its autonomous pentesting platform. The role combines offensive security research with software engineering to turn evolving attack techniques into safe, reliable, repeatable product capabilities that can operate at scale. It is a product engineering role, not consulting or manual pentesting. The engineer will own complex attack capabilities from research and technical design through production delivery and ongoing operation, making technical decisions within the internal network scope. The position also contributes to team development through mentorship, code reviews, and improvements to engineering and research practices. Horizon3.ai is a fully remote company; the role may require up to 10% travel. The stated base salary range is $206,278–$242,680, with the exact salary depending on location, qualifications, experience, and relevant skills. Full-time roles are eligible for an equity package in the form of stock options. The company also lists health, vision, and dental insurance for employees and their families, a flexible vacation policy, and generous parental leave.

Requirements

Deep, hands-on offensive security experience against internal enterprise networks and Active Directory, from initial foothold through domain and enterprise compromise.
Expert-level Python proficiency for large-scale development, with a track record of shipping and maintaining tested, documented, production-quality code.
Strong command of internal network attack techniques, including network protocol exploitation, privilege escalation, lateral movement, and credential access.
Experience with object-oriented design, API integration, data structures, and scalable system components in fast-paced product environments.
Experience designing complex software components or systems with attention to extensibility, operational safety, performance, and long-term maintenance, and explaining architectural decisions.
Track record of independently leading complex, high-impact technical projects, making sound decisions under ambiguity, and identifying business implications and delivery risks.
Strong written and verbal communication, including technical documentation and explaining design choices, risks, and tradeoffs to technical and non-technical stakeholders.
Demonstrated investment in teammates’ growth through mentorship, architectural feedback, and code reviews, and experience improving team processes, tooling, or technical standards.
Offensive security and software engineering background, with a strong interest in turning security research into safe, maintainable product capabilities.

Nice To Haves

OSCP, OSEP, CRTO, or an equivalent offensive security certification.
Experience researching and implementing attacks against SCCM, Windows Admin Center, and other modern Windows management-plane attack surfaces.
Familiarity with Docker, Kubernetes, relational databases such as Postgres, and graph databases such as Neo4j.
Experience developing or contributing to offensive tooling such as BloodHound, Impacket, or netexec.
Hands-on experience with Neo4j and attack-path analysis, including extending models to represent identity and privilege relationships.
Experience integrating security research into production multi-tenant SaaS with attention to testing, reliability, and customer safety.
Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs.
Experience building production-safe autonomous or automated offensive tooling, including using AI/LLM technologies to enhance attack workflows.

Responsibilities

Research and develop novel attack capabilities for integration into NodeZero, focused on autonomous red teaming, internal network breach techniques, and offensive security automation.
Research emerging internal tradecraft, including network protocol exploitation, Active Directory abuse, management-plane attacks, delegation, credential access, and hybrid identity pivots, and turn it into production attack content.
Design, build, and maintain production-grade Python systems, balancing attack effectiveness, operational safety, reliability, scalability, and maintainability.
Acquire, configure, and exploit modern, hardened internal test environments to validate and demonstrate complex attack scenarios.
Monitor public vulnerability databases and threat intelligence sources and incorporate emerging threats into internal network attack modules.
Extend and maintain platform architecture and graph data models for identity, privilege-escalation, and lateral-movement paths.
Help shape team coverage priorities based on customer needs, threat intelligence, and emerging techniques; scope projects and raise risks and tradeoffs proactively.
Mentor teammates and improve team processes, code quality, architectural standards, and research safety practices.
Partner with engineering, product management, and customer-facing teams to resolve issues, enhance features, author technical documentation, and drive customer value.