Senior Offensive Security Engineer

Unity Technologies•Washington, DC

1d•$160,300 - $305,400

About The Position

The Senior Offensive Security Engineer will identify and demonstrate security weaknesses across Unity’s broad attack surface, including its engine and editor, game client runtime, cloud products and services, advertising and monetization business, corporate environment, and AI-assisted and agentic tools. This is an adversarial engineering role focused on realistic attack campaigns rather than checklist penetration testing. The engineer will chain weaknesses into meaningful impact, explain risks and priorities clearly, and work with security and engineering teams to ensure findings are remediated. The role collaborates with Product Security, Infrastructure Security, Security Operations, and engineering teams, and helps develop tooling and automation to extend the coverage of a small offensive security team. Success during the first year includes establishing a risk-based testing plan, completing red team or adversary emulation operations with tracked remediation, improving detection through purple team exercises, and creating reusable automation for continuous checks.

Requirements

At least 6 years of experience in offensive security, including red teaming, penetration testing, purple teaming, or vulnerability research, and leading engagements end to end.
Hands-on experience attacking cloud environments such as GCP, AWS, or Azure, including identity, Kubernetes and containers, and CI/CD.
Strong web application and API security testing skills, including the ability to find logic flaws beyond scanner results.
Solid scripting or programming ability, such as Python, Go, or C/C++, to build tools and exploits.
Experience conducting adversary emulation or red team operations against realistic objectives and working with defenders in purple team exercises.
Clear written and verbal communication skills, including the ability to explain technical risk to engineers and non-technical leaders.
Enjoys working collaboratively, sharing ideas, supporting teammates, and celebrating shared successes.
Sufficient English proficiency for frequent professional verbal and written communication with colleagues and partners worldwide.

Nice To Haves

Experience testing LLM-based products, AI agents, or AI-assisted developer tools.
Reverse engineering, binary exploitation, or game client and anti-cheat security experience.
Experience in gaming, ad tech, or large developer-facing platforms.
Bug bounty participation, CVEs, conference talks, published research, or open-source security tooling.
Relevant certifications such as OSCP, OSEP, OSWE, or CRTO; certifications are useful but do not substitute for a track record.

Responsibilities

Plan and conduct objective-based red team operations against cloud, corporate, and production environments, modeled on threats relevant to Unity.
Run purple team exercises with Security Operations to test and improve detection and response.
Perform deep security testing of Unity products and services, including web applications and APIs, the engine, editor, client runtime, ads and monetization systems, and developer-facing platforms.
Identify and demonstrate attack paths across multi-cloud environments, Kubernetes and containers, CI/CD pipelines, identity systems, and secrets.
Test LLM integrations, AI-native products, and agent workflows for issues such as prompt injection, data leakage, tool misuse, and excessive permissions.
Write clear, prioritized findings with realistic impact; work with owning teams on remediation and retest to confirm fixes.
Build and maintain tools, scripts, and automation to scale adversarial engineering and testing, and turn recurring findings into continuous checks.
Develop a risk-based testing plan with security leadership and engineering teams, and deliver operations with clear findings, executive-ready readouts, and tracked remediation.

Benefits

Comprehensive health, life, and disability insurance.
Commute subsidy.
Employee stock ownership.
Competitive retirement or pension plans.
Generous vacation and personal days.
Leave and family-care programs supporting new parents.
Office food and snacks.
Mental health and wellbeing programs and support.
Employee Resource Groups.
Global Employee Assistance Program.
Training and development programs.
Volunteering and donation matching program.
The role may be eligible for equity awards and company incentive plans, such as annual discretionary bonuses or sales commissions.