Senior Offensive Security Engineer

Delinea•Redwood City, CA

1d•$150,000 - $175,000•Remote

About The Position

Delinea’s Cybersecurity organization is seeking a Senior Offensive Security Engineer to mature its in-house Offensive Security program. The role works collaboratively with Product Development, DevOps, IT, and SecOps to develop penetration testing and red teaming capabilities and continually test the security of Delinea’s products and enterprise. The engineer works across diverse platforms and tools, balances security with business objectives, communicates with technical and non-technical audiences, and solves complex problems with internal and external stakeholders. The position reports to the Sr. Manager, Offensive Security and is based in the United States. It is fully remote. The engineer leads red and purple team operations and penetration testing across enterprise and product environments, including Azure and AWS. Responsibilities also include testing identity infrastructure and application security, reviewing source code, developing and demonstrating proof-of-concept exploits, managing end-to-end testing engagements, and producing clear reports with actionable remediation guidance. The role partners with engineering and IT teams to validate fixes, develops testing tools and automation, contributes to methodologies and playbooks, and stays current with vulnerabilities and attacker tradecraft. The team also uses frontier AI models to evaluate product sources and attack paths.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent work experience.
At least 3 years of hands-on experience with internal and external web application, API, and network penetration testing, including writing formal penetration test reports documenting test details, vulnerabilities, and risks.
Understanding of penetration testing methodology and frameworks, including MITRE ATT&CK, OWASP, and PTES, as well as the OWASP Top 10 and OWASP API Security Top 10.
Hands-on experience with industry-standard offensive tools such as Burp Suite, Nmap, Metasploit, BloodHound, and Impacket.
Experience testing identity and authentication mechanisms, including Active Directory, Entra ID, Kerberos, OAuth 2.0, OpenID Connect, and SAML.
Proficiency in at least one scripting or programming language, such as Python, Go, or PowerShell, for tooling, automation, and exploit development.
Ability to read and review source code in common languages such as C#, Java, or JavaScript/TypeScript to identify security vulnerabilities.
Experience with Azure and AWS cloud-based infrastructure.
Understanding of the Secure Software Development Lifecycle (SSDLC).
Ability to illustrate and explain security vulnerabilities, including proof-of-concept demonstrations, to audiences with minimal security expertise.
Ability to manage multiple engagements concurrently and meet deadlines with minimal supervision.
Must not require any type of U.S. work authorization now or in the future.

Nice To Haves

One or more of the following certifications: ARTE, BSCP, CARTS, CRTL, CRTO, CRTP, eCPPT, eWPT, GPEN, GWAPT, OSCP, OSEP, OSWE, Pentest+, or PNPT.
Experience with command-and-control frameworks such as Cobalt Strike, Sliver, or Mythic, and adversary emulation.
Experience testing containerized and cloud-native environments, including Kubernetes, infrastructure-as-code, and CI/CD pipeline security.
Experience testing identity and access management, privileged access management, or secrets management products.
Experience using AI and LLM-based agents and tooling in testing methodologies, and testing AI and LLM-based features and agents, including prompt injection and the OWASP Top 10 for LLM Applications.
Published CVEs, bug bounty participation, CTF competition, or other public security research contributions.
Experience working with high-security environments subject to regulations such as FedRAMP or ITAR.
Excellent analytical and problem-solving skills with keen attention to detail.

Responsibilities

Lead red and purple team operations, emulating real-world adversary TTPs to test security controls and detection and response capabilities protecting Delinea’s enterprise and products.
Lead internal and external network and infrastructure penetration tests across enterprise and product environments, including Azure and AWS.
Identify and exploit attack paths in identity infrastructure, including Active Directory, Entra ID, Kerberos, and credential and secrets exposure.
Perform source code review in support of testing engagements and use findings to execute targeted attacks.
Create or reproduce and demonstrate proof-of-concept exploits for findings and externally reported vulnerabilities.
Plan and execute penetration testing engagements from scoping and rules of engagement through testing, documentation, reporting, and remediation validation.
Perform manual and automated security testing, as needed, of web applications, APIs, desktop and agent-based clients, and cloud services, focusing on authentication, authorization, session management, and privileged access workflows.
Write clear, well-supported penetration test reports containing reproduction steps, risk ratings, business impact, and actionable remediation guidance.
Partner with Product Development, DevOps, and IT teams to explain findings, support root cause analysis, and validate remediation.
Develop and maintain custom tools, scripts, and automation to improve testing efficiency and coverage.
Contribute to testing methodologies, playbooks, and testing environments, including use of frontier AI models to evaluate product sources and attack paths.
Stay current on emerging vulnerabilities, exploitation techniques, and attacker tradecraft, and share knowledge with the team and broader engineering organization.
Communicate technical findings as actionable insights and recommendations for technical and non-technical stakeholders at all levels.