Senior Offensive Security Engineer

Unity Technologies SF•San Francisco, CA

About The Position

Unity is seeking a Senior Offensive Security Engineer to identify weaknesses across its broad attack surface, including its engine and editor, game client runtime, cloud products and services, advertising and monetization business, corporate environment, and AI-assisted and agentic tools. This is a hands-on offensive security role focused on realistic adversarial testing rather than checklist penetration testing. The engineer will plan and conduct objective-based attack campaigns, chain vulnerabilities to demonstrate meaningful impact, and communicate risk and remediation priorities to engineers and leaders. The role works closely with Product Security, Infrastructure Security, Security Operations, and engineering teams. It includes red teaming and adversary emulation, application and product testing, cloud and infrastructure attack-path analysis, testing AI and agentic systems, coordinating remediation and retesting, and building tools and automation to extend coverage. The engineer is expected to operate safely in production, establish clear rules of engagement, prioritize impactful issues, and build productive partnerships with engineering teams. Within the first 12 months, success includes establishing a risk-based testing plan with security leadership and engineering teams; completing multiple end-to-end red team or adversary emulation operations with executive-ready readouts and tracked remediation; demonstrating measurable detection improvements through purple team exercises; and developing reusable tooling or automation that converts recurring findings into continuous checks. The role offers a location-dependent base salary range: Zone A $160,300–$240,500 USD, Zone B $181,200–$271,800 USD, and Zone C $203,600–$305,400 USD. The position may also be eligible for equity awards and company incentive plans. Final compensation depends on factors including location, experience, background, and skills. Unity describes a range of benefits, with eligibility and offerings varying by country and employment status.

Requirements

At least 6 years of experience in offensive security, such as red teaming, penetration testing, purple teaming, or vulnerability research, including leading engagements end to end.
Hands-on experience attacking cloud environments (GCP, AWS, or Azure), including identity, Kubernetes and containers, and CI/CD.
Strong web application and API security testing skills, including the ability to find logic flaws rather than relying only on scanner results.
Scripting or programming ability, such as Python, Go, or C/C++, to build tools and exploits.
Experience conducting adversary emulation or red team operations against realistic objectives and working with defenders in purple team exercises.
Clear written and verbal communication skills, including the ability to explain technical risk to engineers and non-technical leaders.
Enjoy working as part of a team, sharing ideas, offering support, and celebrating wins together.
Ability to operate safely in production with clear rules of engagement.
Sufficient English proficiency for frequent professional written and verbal communication with colleagues and partners worldwide.

Nice To Haves

Experience testing LLM-based products, AI agents, or AI-assisted developer tools.
Reverse engineering, binary exploitation, or game client and anti-cheat security experience.
Experience in gaming, ad tech, or large developer-facing platforms.
Bug bounty participation, CVEs, conference talks, published research, or open-source security tooling.
Relevant certifications such as OSCP, OSEP, OSWE, or CRTO; certifications are useful but do not substitute for a track record.

Responsibilities

Plan and run objective-based red team operations against Unity's cloud, corporate, and production environments, modeled on relevant threats.
Run purple team exercises with Security Operations to test and improve detection and response.
Conduct deep security testing of Unity products and services, including web applications and APIs, the engine, editor and client runtime, ads and monetization systems, and developer-facing platforms.
Identify and demonstrate attack paths across multi-cloud environments, Kubernetes and containers, CI/CD pipelines, identity, and secrets.
Test LLM integrations, AI-native products, and agent workflows for prompt injection, data leakage, tool misuse, excessive permissions, and related issues.
Write clear, prioritized findings with realistic impact, work with owning teams on remediation, and retest to confirm fixes.
Build and maintain tools, scripts, and automation to scale adversarial engineering and testing and turn repeated findings into continuous checks.
Develop a risk-based testing plan for high-value targets in agreement with security leadership and owning engineering teams.
Produce clear findings, executive-ready readouts, and tracked remediation for red team and adversary emulation operations.
Operate safely in production with clear rules of engagement, prioritize real impact over finding volume, and build trust with engineering teams.

Benefits

Comprehensive health, life, and disability insurance.
Commute subsidy.
Employee stock ownership.
Competitive retirement or pension plans.
Generous vacation and personal days.
Leave and family-care programs supporting new parents.
Office food snacks.
Mental health and wellbeing programs and support.
Employee Resource Groups.
Global Employee Assistance Program.
Training and development programs.
Volunteering and donation matching program.
Potential eligibility for equity awards and company incentive plans, such as annual discretionary bonuses or sales commissions.