Staff Attack Engineer, External

Horizon3

1d•$238,000 - $280,000•Remote

About The Position

Horizon3 is seeking a Staff Attack Engineer to provide technical leadership for external attack capabilities in NodeZero, its autonomous penetration-testing platform. The role will help shape technical direction, research and content roadmaps, and engineering practices for discovering and modeling external attack surfaces. The work focuses on turning manual reconnaissance and multi-step attack techniques into safe, reliable, repeatable workflows that operate autonomously at large scale. It is not a consulting or manual penetration-testing position. The engineer will build scalable reconnaissance and asset-discovery workflows; research and parse unstructured external data; connect high volumes of information in attack-path models; and automate end-to-end attack workflows. The role also includes researching emerging tradecraft, maintaining test environments, prioritizing coverage, mentoring engineers, collaborating across teams, and producing documentation and research. The company is fully remote, and the position may require up to 5% travel. The listed annual base salary range is $238,000–$280,000, depending on location, qualifications, experience, and skills. Full-time roles are eligible for an equity package in the form of stock options. Mentioned benefits include health, vision, and dental insurance for employees and their families, a flexible vacation policy, and generous parental leave.

Requirements

Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation.
At least 10 years of hands-on experience in offensive security, security research, or security-focused software engineering, including recent work building and shipping offensive tooling.
Demonstrated experience building reconnaissance and discovery systems that operate at scale.
Strong ability to research and parse large amounts of messy, unstructured external data and make it usable and trustworthy.
Experience collecting, storing, and connecting high volumes of data and reasoning about relationships among identities, assets, and trust.
Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and movement among identities, tenants, and services.
Experience automating multi-step attack workflows end to end.
Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code.
Ability to independently research unfamiliar systems and technologies and quickly become a subject matter expert.
Strong written and verbal communication skills, including clear technical documentation.
Interest in building products, not only finding vulnerabilities.

Nice To Haves

OSCP, OSEP, CRTO, or equivalent offensive certifications.
Experience with large-scale internet data sources and tooling, such as certificate transparency, passive DNS, and internet-wide scanning.
Experience with cloud, SaaS, and hybrid identity attack surfaces, including Entra ID, Okta, AWS, and on-premises-to-cloud pivots.
Experience with external-to-internal pivoting and how perimeter footholds lead to additional access.
Experience with graph databases, attack-path analysis, data lakes, or high-volume data storage and processing.
Experience developing or contributing to offensive or reconnaissance tooling.
Public contributions to the field, such as open-source tools, technical blog posts, conference talks, or published CVEs.
Experience building production-safe autonomous or automated offensive tooling.

Responsibilities

Design, build, and maintain scalable reconnaissance workflows that discover, enumerate, and fingerprint external-facing assets and services using production-grade Python.
Research and parse large volumes of external-facing data, including unstructured and inconsistent sources, and convert it into accurate, actionable information.
Develop parsing and enrichment approaches for difficult-to-structure data such as banners, web content, documents, and error output.
Collect, store, and connect high volumes of information, and extend attack-path modeling and graph data models to represent identity, privilege, and relationship paths.
Traverse identity relationships across external surfaces, including accounts, tenants, SSO and federation, exposed credentials, and third-party services, to identify paths from exposure to compromise.
Automate multi-step attack workflows spanning discovery, credential access, initial access, and post-exploitation, with safely proven attack paths.
Research emerging external tradecraft and turn it into production attack content, emphasizing techniques that can succeed against hardened, monitored targets.
Create and maintain representative test environments to validate, demonstrate, and regression-test attack scenarios.
Build for production safety and scale while respecting target and customer environments, rate limits, and scope.
Set priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques.
Mentor and develop attack engineers and improve code quality, research rigor, and operational safety.
Collaborate with engineers, product managers, and customer-facing teams; write internal documentation and external research and blog posts.