Senior Offensive Security Engineer

World Wide Technology is hiring a Senior Offensive Security Engineer for its Information Security team. The role focuses on leading offensive security programs and engagements across web applications, networks, cloud environments, and internal infrastructure, while developing tooling, conducting threat modeling, and communicating risks and remediation strategies to stakeholders.

Responsibilities:

• 5-7+ years hands-on offensive security or penetration testing experience in web application, network, and cloud environments
• Demonstrated experience designing, leading, or maturing an offensive security program or methodology
• Experience scoping and overseeing internal and third-party offensive security engagements including rules of engagement, authorization, and scope management
• Expert command of offensive security tools including Burp Suite, Kali Linux toolset, and manual exploitation techniques including bypassing modern defenses
• Hands-on Active Directory and internal network exploitation experience (e.g., Kerberoasting, delegation abuse, lateral movement, privilege escalation)
• Working knowledge of cloud attack surfaces, including IAM misconfigurations, container security, and CI/CD pipeline attacks
• Experience using AI tools to accelerate offensive security workflows
• Deep understanding of OWASP Top 10, MITRE ATT&CK, CVSS and other severity scoring frameworks, and full attack-chain thinking
• Scripting and automation ability to build or extend custom tooling (e.g., Python, Bash, Powershell)
• Hands-on threat modeling experience (STRIDE, PASTA, or equivalent)
• Understanding of secure handling, storage, and reporting of sensitive engagement data and findings
• Excellent interpersonal, written, and verbal communication – able to explain and document security risk and remediation credibly to both technical and non-technical stakeholders
• Self-starter, team player, and enthusiasm for learning
• Applicants must be authorized to work in the United States without sponsorship. We are unable to provide sponsorship now or in the future for this position
• Bachelor’s degree in Computer Science, Software Engineering, Information Security, or a related field — or equivalent hands-on experience
• OSCP, OSWE, OSEP, or equivalent red-team oriented certification
• Cloud security certification (AWS, Azure, GCP)
• Experience with C2 frameworks or interest in growing adversary emulation capabilities
• Familiarity with SIEM/EDR or detection engineering from a defender’s perspective
• Programming experience beyond scripting for exploit development or evasion tooling (C/C++, JavaScript, Go, Python)
• Working knowledge of SAST, DAST, SCA, and vulnerability management tooling
• Experience building or maintaining offensive security testing playbooks
• Familiarity with compliance frameworks and compliance-driven testing requirements (SOC 2, ISO 27001, etc.)
• Track record of mentoring team members

Requirements:

• 5-7+ years hands-on offensive security or penetration testing experience in web application, network, and cloud environments
• Demonstrated experience designing, leading, or maturing an offensive security program or methodology
• Experience scoping and overseeing internal and third-party offensive security engagements including rules of engagement, authorization, and scope management
• Expert command of offensive security tools including Burp Suite, Kali Linux toolset, and manual exploitation techniques including bypassing modern defenses
• Hands-on Active Directory and internal network exploitation experience (e.g., Kerberoasting, delegation abuse, lateral movement, privilege escalation)
• Working knowledge of cloud attack surfaces, including IAM misconfigurations, container security, and CI/CD pipeline attacks
• Experience using AI tools to accelerate offensive security workflows
• Deep understanding of OWASP Top 10, MITRE ATT&CK, CVSS and other severity scoring frameworks, and full attack-chain thinking
• Scripting and automation ability to build or extend custom tooling (e.g., Python, Bash, Powershell)
• Hands-on threat modeling experience (STRIDE, PASTA, or equivalent)
• Understanding of secure handling, storage, and reporting of sensitive engagement data and findings
• Excellent interpersonal, written, and verbal communication – able to explain and document security risk and remediation credibly to both technical and non-technical stakeholders
• Self-starter, team player, and enthusiasm for learning
• Applicants must be authorized to work in the United States without sponsorship. We are unable to provide sponsorship now or in the future for this position
• Bachelor's degree in Computer Science, Software Engineering, Information Security, or a related field — or equivalent hands-on experience
• OSCP, OSWE, OSEP, or equivalent red-team oriented certification
• Cloud security certification (AWS, Azure, GCP)
• Experience with C2 frameworks or interest in growing adversary emulation capabilities
• Familiarity with SIEM/EDR or detection engineering from a defender's perspective
• Programming experience beyond scripting for exploit development or evasion tooling (C/C++, JavaScript, Go, Python)
• Working knowledge of SAST, DAST, SCA, and vulnerability management tooling
• Experience building or maintaining offensive security testing playbooks
• Familiarity with compliance frameworks and compliance-driven testing requirements (SOC 2, ISO 27001, etc.)
• Track record of mentoring team members