Staff Offensive Security Engineer

Cloaked•New York, NY

1d•$200,000 - $250,000•Hybrid

About The Position

Cloaked is seeking a Staff Offensive Security Engineer to act as a persistent, advanced threat against their own infrastructure. This role requires custom exploit development, logical subversion, and a strategic mindset, focusing on mapping business risk, executing targeted campaigns, and elevating engineering teams rather than just finding a high volume of vulnerabilities. The engineer will operate with absolute autonomy, designing and executing campaigns to cover the attack surface with rigorous test cases. They will go beyond off-the-shelf scanners to find complex logical flaws and chained vectors, building complex offensive systems to test defenses at scale. Ruthless prioritization based on catastrophic business risk is essential. The role involves partnering with product and engineering leaders to understand and weaponize business logic, and then teaching engineering teams to eradicate entire attack classifications at the root. Ubiquitous ownership is expected, providing hands-on security guidance, architecture review, and audit support across all business units, from physical systems to the flagship product.

Requirements

Multi-disciplinary scars, coding fluency, and a deep understanding of modern architecture.
Ability to write code and anticipate architectural fractures.
Diverse background (customer support, QA/test, development, blue team, red team, etc.).
Fluency in multi-cloud environments and complex SaaS architectures.
Understanding of how to abuse IAM trust boundaries, tenant isolation flaws, and API misconfigurations.
Communication skills to translate complex exploits into actionable engineering requirements without condescension.

Responsibilities

Operate as a persistent, advanced threat against the company's infrastructure.
Design, dictate, and execute campaigns for comprehensive attack surface coverage.
Develop custom exploits and identify complex logical flaws and chained vectors.
Engineer complex, future-forward offensive systems.
Prioritize targets based on catastrophic business risk.
Partner with product and engineering leaders to understand and weaponize business logic.
Deconstruct attack paths and teach engineering teams to eradicate attack classifications.
Drive foundational system hardening and secure development standards.
Provide hands-on security guidance, architecture review, and audit support across business units.
Red-team physical systems and analyze the flagship product.