Staff Offensive Security Engineer

Greenlight is a family technology company that provides financial tools, safety features, and family management products. The Staff Offensive Security Engineer will lead continuous offensive security validation across digital platforms, mobile applications, cloud infrastructure, corporate environments, and hardware devices while developing long-term security strategy, conducting adversary simulations, researching vulnerabilities, and mentoring engineers.

Responsibilities:

• Lead Technical Strategy: Define the long-term vision for offensive security at Greenlight, moving beyond point-in-time testing to continuous security validation
• Red Teaming & Adversary Simulation: Design and execute complex, multi-stage adversary simulations targeting our cloud infrastructure (AWS), mobile applications (iOS/Android), and internal corporate environments
• Vulnerability Research: Conduct deep-dive research into high-risk areas of our ecosystem, identifying zero-day vulnerabilities or sophisticated logic flaws that automated tools miss
• Pave the "Golden Path": Partner with DevOps and Engineering to build automated security guardrails and "self-healing" infrastructure that prevents common attack vectors from being introduced
• Incident Response Support: Work closely with the Detection and Response team to improve our monitoring capabilities by performing "purple team" exercises to validate alert coverage
• Mentorship: Act as a force multiplier by mentoring senior and mid-level engineers, fostering a culture of security-minded development across the entire R&D organization

Requirements:

• 8+ years of experience in offensive security, red teaming, or penetration testing, with a proven track record of uncovering critical vulnerabilities in complex environments
• Deep understanding of AWS security architecture, including IAM bypass techniques, container escapes (Kubernetes), and serverless security
• Experience with manual code review (Node.js, Python, or Go) and bypass techniques for modern web and mobile security controls
• Ability to script in Python, Bash, or Go to automate exploitation chains or integrate security testing into CI/CD pipelines
• The ability to translate complex technical risks into business impact for executive stakeholders while remaining a trusted peer to software engineers
• You are curious, persistent, and think outside the box to find ways around traditional security controls
• You believe that "breaking things" is only half the job; the real value is in helping the team build them back stronger
• You take pride in your work and feel a deep sense of responsibility for the safety of our families and their finances
• OSCP/OSCE, GXPN, or equivalent demonstration of deep technical skill