Senior Offensive Security Engineer

DRW•New York, NY

5h•$175,000 - $275,000

About The Position

DRW is building out its offensive security capability, and we’re looking for a Senior Offensive Security Engineer to lead the charge. In this role, you’ll plan and execute red team engagements, penetration tests, and adversary simulations against our trading infrastructure, corporate environment, and cloud platforms, acting as a trusted adversary who helps us find and fix weaknesses before anyone else does. You’ll work closely with our security, infrastructure, and trading teams to translate what you find into real improvements, and you’ll help shape the methodology, tooling, and roadmap for offensive security at DRW as the function matures. This is a hands-on, high-trust role for someone who thinks like an attacker, communicates like a partner, and cares about making the firm measurably harder to compromise.

Requirements

5+ years of hands-on experience in offensive security, penetration testing, or red teaming, including full engagement lifecycle work: reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration
Strong scripting or programming ability for building and adapting offensive tooling
Solid understanding of networking fundamentals, Windows, macOS, and Linux internals, identity providers, and cloud platforms
Practical experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for it
Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve
A track record of clear, precise reporting and communication and you can translate technical findings into risk that both engineers and executives understand
Experience with smart contract auditing and blockchain security
Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling
A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws

Responsibilities

Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK
Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance
Design and build custom tooling, scripts, and exploits to emulate adversary behavior, test control effectiveness, and validate detection coverage
Partner with the Security Engineering and SOC teams in purple-team exercises to close gaps between what attackers can do and what defenders can see
Run social engineering and phishing simulations to assess and improve organizational security awareness
Identify, validate, prioritize, and track vulnerabilities and control weaknesses through to remediation in collaboration with infrastructure, platform, and application owners
Present engagement results and risk narratives to both technical teams and senior leadership in a way that drives action
Stay current on the threat landscape, emerging TTPs, and offensive tooling, and bring that knowledge back into DRW’s defenses
Assess the security of AI and LLM-integrated systems, including prompt injection, model manipulation, data poisoning, and abuse of agentic workflows, and work with teams building these systems to harden them
Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge
Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team