Staff Security Engineer, Red Team

Instacart

74d • $216,000 - $289,000

About The Position

As a Staff Security Engineer, Red Team, you will lead offensive security efforts to proactively identify vulnerabilities, simulate real-world threats, and measure the effectiveness of defenses across Instacart’s systems. You will design and execute creative red team campaigns while collaborating with blue teams and other stakeholders to strengthen our ability to detect, respond to, and remediate threats swiftly. Your expertise will drive improvements in the security posture of our products, platforms, and operations.

Requirements

• 7+ years of experience in offensive security, penetration testing, or a related field, with proven expertise in red team operations.
• Strong understanding of adversary tactics, techniques, and procedures (TTPs), as well as frameworks like MITRE ATT&CK.
• Skilled in developing custom exploits, tools, or scripts using programming languages (e.g., Python, Go, C/C++, etc.).
• Proficient in penetration testing for various environments, such as web applications, cloud infrastructures, and on-prem systems.
• Strong knowledge of Windows, Linux, and macOS operating systems, including relevant exploitation techniques.
• Experience conducting collaborative purple team exercises and improving detection and response strategies.
• Ability to deliver comprehensive findings and recommendations tailored to technical and non-technical audiences.
• Exceptional organizational and self-management skills for handling complex, cross-functional projects.

Nice To Haves

• Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Engineering, or related work experience.
• Experience with red team tools such as Cobalt Strike, Metasploit, Empire, or similar frameworks.
• Familiarity with threat modeling, attack simulations, and adversary emulation frameworks.
• Expertise in securing modern cloud environments (AWS, GCP, Azure) and ephemeral systems like containers or serverless architectures.
• Recognized certifications such as OSCP, OSEP, GIAC, GXPN, or similar offensive security credentials.
• Strong knowledge of evasion techniques and bypassing security controls (e.g., AV, EDR, WAF).

Responsibilities

• Design and execute comprehensive red team operations targeting Instacart's unique attack surface (mobile apps, web platform, logistics systems, payment processing, customer/shopper data)
• Develop annual red team roadmap aligned with business priorities and emerging threats to e-commerce platforms
• Collaborate with leadership to prioritize high-value targets and realistic threat scenarios
• Present findings and strategic recommendations to executive leadership
• Lead complex red team engagements simulating advanced persistent threats and organized cybercrime groups
• Conduct adversary emulation exercises based on threat intelligence relevant to retail, fintech, and logistics sectors
• Test security controls across cloud infrastructure (AWS/GCP), mobile applications (iOS/Android), APIs, and internal networks
• Execute social engineering campaigns against employees, shoppers, and corporate functions
• Develop custom tooling, exploits, and tradecraft specific to Instacart's technology stack

Benefits

• Highly market-competitive compensation and benefits
• Remote work flexibility
• New hire equity grant and annual refresh grants

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Number of Employees: 1,001-5,000 employees