Security Engineer Jobs

About The Position

Requirements

• Bachelor's degree in Computer Science, Management Information Systems, Cybersecurity, Information Technology, or a related field, or an equivalent combination of education and experience.
• Minimum 3–5 years conducting adversary emulation, penetration testing, red team operations, or advanced security assessments.
• Deep hands-on experience leading multi-stage adversary emulations and complex assessments across several enterprise technology domains.
• Advanced knowledge of identity attacks, endpoint tradecraft, network protocols, application and API exploitation, cloud attack paths, persistence, command and control, evasion, and data access techniques.
• Experience designing rules of engagement, managing testing risk, coordinating deconfliction, protecting sensitive data, and making stop-work decisions during live exercises.
• Production-quality engineering experience using Python, Go, C#, C/C++, Rust, PowerShell, JavaScript, APIs, infrastructure automation, or comparable technologies.
• Experience developing or modifying offensive tools, payloads, infrastructure, attack automation, and validation methods while maintaining operational security.
• Advanced technical judgment to balance realism, stealth, evidence, business impact, legal and ethical boundaries, safety, and operational continuity.
• Strong communication, facilitation, and stakeholder engagement skills, including constructive debriefs and concise communication to senior leadership.
• Must reside in Texas and be able to perform all work from a home in Texas.
• For home work, must have a reliable internet provider, the minimum internet connection required by RBFCU, the ability to hard-wire directly to the modem, and a safe, suitable, distraction-free workspace.

Nice To Haves

• Experience emulating advanced threat actors in hybrid and multi-cloud environments, identity systems, software supply chains, data platforms, AI systems, or critical infrastructure.
• Experience with advanced application exploitation, exploit development, malware research, reverse engineering, cloud red teaming, wireless testing, or hardware security.

Responsibilities

• Lead complex, multi-domain adversary-emulation campaigns targeting critical services, high-value assets, privileged identities, cloud control planes, applications, data, and software delivery systems.
• Translate threat intelligence and business context into campaign objectives, adversary profiles, attack hypotheses, target selections, techniques, success criteria, and measurable defensive outcomes.
• Design engagement plans, rules of engagement, safety controls, communications, deconfliction, escalation paths, data-handling requirements, and technical workstreams.
• Execute and supervise advanced attack activity involving stealth, persistence, identity compromise, lateral movement, cloud privilege escalation, application exploitation, data access, and objective demonstration.
• Lead controlled social-engineering, physical, wireless, third-party, or assumed-breach scenarios when explicitly approved by the required authorities.
• Develop custom tooling, implants, payloads, test harnesses, automation, redirectors, infrastructure, and operational-security practices for authorized objectives.
• Evaluate defense-in-depth performance across prevention, identity, segmentation, telemetry, detection, investigation, containment, eradication, recovery, and resilience.
• Lead purple-team exercises and turn observations into detections, hunts, playbooks, architecture improvements, control validation, and remediation priorities.
• Produce executive and technical narratives connecting attack paths and defensive gaps to business risk, systemic causes, and prioritized corrective actions.
• Mentor offensive and defensive engineers, conduct technical reviews, and lead lessons-learned activities to improve engagement safety, realism, repeatability, and impact.