Senior Attack Engineer, OCI

Horizon3

1d•$206,278 - $242,680•Remote

About The Position

Horizon3.ai is hiring a Senior Attack Engineer with Oracle Cloud Infrastructure (OCI) expertise to build the next generation of cloud attack capabilities for its NodeZero platform. The role focuses on creating OCI attack content from the ground up as OCI adoption grows among large enterprises, government organizations, and AI-focused infrastructure providers. The engineer will research Oracle Cloud services, identify attack paths and misconfigurations, develop offensive capabilities, and help shape how NodeZero assesses Oracle Cloud environments at scale. This is a strategic, hands-on product engineering role rather than a maintenance role, with direct influence on how OCI attacks are integrated into the platform. The successful candidate will join the NodeZero Attack team and collaborate with software engineers, attack engineers, and offensive security subject-matter experts. The position is fully remote and may require up to 10% travel. The stated base salary range is $206,278–$242,680, determined by location, qualifications, experience, and relevant skills. Full-time roles are eligible for stock options. Benefits include health, vision, and dental insurance for employees and their families, a flexible vacation policy, and generous parental leave.

Requirements

Hands-on experience with OCI security and offensive cloud operations, including the ability to reason about IAM permissions, service identities, trust, and resource access.
Advanced understanding of cloud attack paths and cloud-native security concepts.
Python engineering skills and experience turning security research or manual techniques into dependable, production-quality automation or product capabilities.
Passion for building products, not just finding vulnerabilities.
At least 4 years of professional software engineering and/or offensive security experience.
Experience with cloud penetration testing, red teaming, offensive security research, or building cloud security products.
Documented history of collaborating with diverse engineering teams to develop products as an individual contributor.

Nice To Haves

Experience with cloud privilege escalation and identity attacks.
Familiarity with AWS, Azure, or GCP offensive security.
Experience integrating security research into production software.
Experience with OKE, Kubernetes, Terraform, Oracle Cloud APIs, or cloud-native CI/CD.
Contributions to security research, open-source projects, conference talks, or vulnerability disclosure.
Experience mapping cloud attack coverage to frameworks such as MITRE ATT&CK for Cloud.

Responsibilities

Research OCI attack paths, identity and trust relationships, service misconfigurations, and emerging attacker techniques.
Design, implement, and validate production-quality Python attack capabilities spanning OCI IAM, service accounts and workload identities, compute, Kubernetes/OKE, storage, databases, secrets, networking, and other cloud-native services.
Chain individual weaknesses into realistic attack paths with reliable proof of exploitability and clear, actionable customer outcomes.
Build and maintain safe, repeatable attack logic and supporting tests; investigate failures and improve reliability, precision, and maintainability.
Collaborate with software engineers, attack engineers, and offensive security SMEs to bring new capabilities into production.
Use rigorous software development practices to implement OCI-based attack paths based on direction from the technical lead and team manager.