Sr Information Security Engineer - Security Red Team

Williams-Sonoma•Brooklyn, NY

14h•Onsite

About The Position

As a Senior Information Security Engineer on the Security Red Team, you will lead authorized offensive security engagements from planning through execution, reporting, and remediation validation. This hands-on technical lead role coordinates internal Red Team resources and external testing partners, translates technical findings into actionable risk reduction, and mentors engineers without formal people-management responsibilities. The role is onsite in the Brooklyn, NY office Monday through Thursday. You will be part of the Enterprise Cyber Security organization, which evaluates security controls and identifies ways to strengthen enterprise defenses. The Red Team collaborates with Security Operations, Detection Engineering, Security Engineering, and business partners to assess realistic attack paths and improve resilience.

Requirements

5+ years of experience in offensive security, penetration testing, Red Team operations, or related security engineering.
Demonstrated experience leading authorized security assessments and communicating findings to varied audiences.
Hands-on knowledge of enterprise identity, networking, operating systems, cloud platforms, and web application security.
Experience documenting scope, safety controls, evidence, and actionable remediation guidance.
Ability to coordinate cross-functional engagements and lead technical work without direct-report authority.
Must work onsite in the Brooklyn, NY office Monday through Thursday.

Nice To Haves

Experience with Cobalt Strike, BloodHound Enterprise, Burp Suite, Metasploit, and Kali Linux.
Experience conducting Purple Team exercises and mapping observations to MITRE ATT&CK.
Relevant offensive security certifications or experience with scripting and assessment automation.

Responsibilities

Plan and lead authorized internal and external penetration tests, adversary simulations, and Red Team engagements across enterprise environments.
Define engagement scope, objectives, rules of engagement, written authorization, testing windows, safety controls, and communication plans to minimize production disruption.
Coordinate internal Red Team engineers and external penetration-testing vendors, including deliverables and follow-up testing.
Conduct or direct assessments of Active Directory and identity attack paths, cloud environments, web applications, APIs, and infrastructure.
Lead Purple Team exercises with SOC and Detection Engineering to validate visibility, detection coverage, and response effectiveness.
Conduct authorized social engineering assessments in accordance with approved scope and company policy.
Use appropriate tools for approved engagements, including Cobalt Strike, BloodHound Enterprise, Burp Suite, Metasploit, and Kali Linux.
Produce technical reports and executive-level summaries explaining exposure, business impact, evidence, and prioritized remediation recommendations.
Coordinate remediation follow-up, validation, and retesting with application, infrastructure, and security owners.
Mentor team members, develop reusable engagement methodologies, and identify safe opportunities for automation and AI-assisted analysis.

Benefits

A generous discount on all WSI brands.
A 401(k) plan and other investment opportunities.
Paid vacations, holidays, and time off to volunteer.
Health benefits, including dental and vision insurance and same-sex domestic partner benefits.
Tax-free commuter benefits.
A wellness program supporting physical, financial, and emotional health.
In-person and online learning opportunities through WSI University.
Cross-brand and cross-function career opportunities.
Resources for self-development.
Advisor (Mentor) program.
Career development workshops, learning programs, and speaker series.
Compensation may include benefits, paid time off, merit, and bonus opportunities.