Senior Security Engineer, Offensive Security

Liftoff • United States (Remote), CA

1d • $184,000 - $250,000

About The Position

Liftoff is hiring a Senior Security Engineer, Offensive Security, to own internal offensive testing and lead the transition from point-in-time penetration tests to continuous, AI-assisted testing. The role independently plans security assessments, safely validates vulnerabilities, partners with engineering teams through remediation and retesting, and builds sustained knowledge of Liftoff’s source code and systems.

The engineer contributes across application, cloud, and infrastructure security, supporting Accelerate and MX as priorities change. The role also shares the security team’s on-call and incident-response responsibilities, including occasional off-hours response and post-incident follow-up. It combines hands-on security testing with software engineering, automation, and collaboration across engineering and Detection & Response teams.

Requirements

• At least 5 years of relevant security engineering experience, including substantial hands-on penetration testing of applications and infrastructure.
• Excellent judgment in prioritizing testing by risk, assessing production impact, and safely validating exploits without unnecessary disruption.
• Experience independently owning assessments and partnering with engineering teams from initial findings through remediation and retesting.
• Ability to write production-quality code for security tools and automation, review pull requests, and navigate large, unfamiliar codebases.
• Ability to develop safe proof-of-concept code and independently validate AI-generated code and findings.
• Strong understanding of application and API security, authentication and authorization, network security, and common vulnerability classes.
• Hands-on experience assessing cloud and infrastructure security, including identity and access controls, configuration, and attack paths.
• Ability to quickly understand complex systems and architecture and contribute across application, cloud, and infrastructure security.
• Practical software engineering habits, including testing, observability, version control, peer code review, continuous integration, and blameless postmortems.
• Strong technical writing skills for assessment plans, proposals, reproducible findings, runbooks, and post-incident reviews that support engineering decisions.
• Ability to explain exploitability and business impact clearly in writing and conversation.
• Willingness to share the security team’s on-call and incident-response responsibilities, including occasional off-hours response.

Nice To Haves

• Experience with Go, Python, Clojure, or JavaScript; ability to work across languages matters more than a specific language.
• Experience building AI-assisted security testing workflows and measuring the accuracy and usefulness of their results.
• Experience securing large-scale cloud systems, mobile advertising, or other high-volume SaaS environments.

Responsibilities

• Independently plan and execute internal penetration tests across applications, APIs, cloud infrastructure, and corporate systems, prioritizing assessments by risk and business impact.
• Define testing scope and rules of engagement with system owners, assess production risk, and select safe methods for validating vulnerabilities.
• Combine hands-on testing with source-code review and architectural analysis to identify vulnerabilities and demonstrate realistic attack paths.
• Partner with engineering teams to explain findings, agree on practical fixes, track remediation, and retest to confirm risks are resolved.
• Maintain knowledge of Liftoff’s systems and attack surface, revisit high-risk attack paths as systems change, and turn confirmed findings into repeatable tests.
• Build testing tools and workflows that combine hands-on assessments with ongoing automated testing and remediation validation.
• Make security testing self-service where practical through reusable tests, documented assessment and retesting workflows, and clear remediation guidance.
• Support the annual third-party penetration test for independent validation and customer and audit requirements; coordinate scope and follow findings through remediation.
• Lead adoption of AI-assisted offensive security tooling by evaluating platforms and building workflows for code analysis, test generation, and finding triage; measure coverage, accuracy, and effort saved.
• Partner with Detection & Response to translate validated attack paths and offensive findings into detection improvements and incident-response exercises.
• Work across application, cloud, and infrastructure security as priorities change, including Accelerate and MX.
• Share the team’s on-call and incident-response rotation, including occasional off-hours response and post-incident follow-up.

Benefits

• Competitive salaries and equity.
• Benefits designed to support employee well-being and performance, which may include medical coverage, wellness stipends, and additional perks based on country of residence.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed