Senior Offensive Security Engineer

Group 1001

2d•$200,000 - $270,000•Remote

About The Position

Group 1001 is seeking a hands-on Senior Offensive Security Engineer to lead penetration testing and red team operations across cloud, endpoint, application, and API environments. The position owns the technical direction of the offensive testing program, including penetration tests, red and purple team exercises, a private bug bounty program, and external attack surface reduction. The engineer will work with development teams to align testing with release cycles and mature application security and SDLC practices. The role reports to the AVP of Security Lifecycle & Architecture and collaborates with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit. If additional headcount is approved, the engineer will provide technical direction and mentorship to another offensive security engineer. Success in the role means delivering a consistent, well-scoped penetration testing cadence; operating testing, bug bounty, and attack surface management functions that reduce risk and improve detection and response; partnering effectively with development teams; and providing leadership with clear, metrics-driven reporting.

Requirements

At least 8 years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles.
Demonstrated experience testing cloud environments (Azure, AWS, and/or GCP), endpoints, web and desktop/native applications, and APIs.
Experience conducting full-scope red team operations and purple team exercises.
Strong background in vulnerability triage, risk prioritization, and guiding remediation with development, infrastructure, and security teams.
Experience managing or significantly contributing to a bug bounty program.
Familiarity with continuous attack surface management platforms and external exposure reduction.
Solid understanding of adversary tactics, techniques, and procedures (TTPs), and modern detection and response capabilities.
Excellent written and verbal communication skills, including the ability to present findings and risk to executives and non-technical stakeholders.

Nice To Haves

Experience developing custom tooling, exploits, implants, payloads, or evasion techniques.
Hands-on experience with commercial and open-source offensive tools such as Cobalt Strike, custom C2 frameworks, and Burp Suite, and ability to build or modify tools.
Programming or scripting proficiency in languages such as Python, PowerShell, C/C++, or Rust sufficient for custom tooling or exploit development.
Relevant certifications such as OSCP, OSWE, OSCE, GXPN, or equivalent demonstrated expertise.
Experience working with or managing third-party penetration testing vendors.
Experience working with development teams on secure SDLC, DevSecOps, or secure code review.
Knowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives.
Prior experience in financial services, insurance, or other regulated environments, such as NYDFS 23 NYCRR 500.
Prior experience mentoring or leading other security engineers.

Responsibilities

Plan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, endpoints, internal web and desktop applications, and APIs, providing clear, prioritized remediation guidance.
Partner with development teams to understand release schedules, integrate testing into delivery cycles, and mature application security and SDLC practices.
Lead and perform quarterly red team and purple team operations that simulate real-world adversary tactics and test detection, response, and resilience.
Manage the private bug bounty program, including strategy, scope, vulnerability triage, severity validation, and remediation coordination.
Operate the enterprise continuous attack surface monitoring platform, triage external findings, and drive remediation to closure.
Oversee third-party testing vendors, including the annual external penetration test; define scope and objectives, review deliverables, and ensure results align with internal priorities and regulatory expectations.
Validate remediation through retesting and track findings to closure with application, infrastructure, and security owners.
Translate offensive findings into defensive improvements in collaboration with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit.
Develop and refine offensive tooling, techniques, and processes to improve program effectiveness and efficiency.
Track and report program metrics, risk reduction, and security posture improvements, and present results to technical teams and senior leadership.
Provide technical leadership, coaching, and work direction to additional offensive security team members as the team grows.