Senior Security Engineer, Offensive Security and Detection

Vancord provides managed services across infrastructure and security. The company is seeking a Senior Security Engineer who will split time between offensive security work and defensive detection engineering, including penetration testing, engagement delivery, and building or tuning detections that validate and improve security coverage. The role also supports client-facing consulting, presales scoping, reporting, and collaboration with SOC and product teams to strengthen managed security services.

Responsibilities:

• Lead and perform in depth penetration tests across a wide range of digital infrastructures, including web applications and network systems, to identify and exploit vulnerabilities
• Own the end-to-end delivery of security engagements, including scoping, testing, and presentation of findings to clients
• Create detailed reports outlining methods used and the implications of findings, proposing actionable mitigation strategies tailored to both technical and executive audiences
• Evaluate and analyze results from security assessments of cloud infrastructure and services such as AWS, Azure, Microsoft 365, and Google Workspace
• Develop and refine playbooks, repeatable processes, and internal tooling to improve consistency, efficiency, and knowledge distribution across the team
• Contribute to presales engineering efforts, including scoping engagements and advising on testing approaches
• Stay current on penetration testing methodologies, tooling, and threat landscape developments, and translate them into refined testing strategies and expanded team capability
• Develop and tune detection content across Elastic Security, Microsoft Defender XDR, Microsoft Sentinel, and CrowdStrike Falcon, writing and maintaining correlation rules, analytics, and hunting queries in KQL, ES|QL, EQL, and equivalent query languages
• Map detection coverage against MITRE ATT&CK, identify gaps, and help drive the roadmap to close them
• Improve signal to noise through systematic tuning, suppression logic, and enrichment rather than ad hoc fixes, and document the reasoning so analysts understand what a rule catches, what it misses, and why it fires
• Build automation workflows in Vancord's SOAR platform to accelerate triage, enrichment, and response, reducing analyst manual workload and mean time to respond
• Conduct structured threat hunts across the managed customer fleet, informed by current adversary tradecraft and your own offensive experience
• Serve as a senior technical resource during complex investigations and high severity incidents, contributing attacker perspective to scoping, containment, and root cause analysis
• Support ECS aligned telemetry pipelines and normalization workflows so that detections operate on consistent, high-fidelity data across a multi-tenant environment
• Keep detection content consistent across the platforms Vancord operates, contributing to detection-as-code practices as they mature, so a detection built for one customer platform reaches the rest of the fleet
• Translate techniques observed or executed during offensive engagements into concrete detection requirements, test cases, and coverage improvements
• Run adversary emulation and detection validation exercises against Vancord's own detection stack, then work with the SOC to close what does not fire
• Provide feedback to Product and Engineering to improve Vantage MDR, particularly on detection content and coverage
• Bring defensive telemetry insight back into offensive engagements, helping clients understand not just what was exploitable but what their monitoring would and would not have caught
• Interface with clients and staff with professionalism and a positive attitude, serving as a trusted advisor on security matters
• Provide guidance, mentorship, and technical oversight to members of Vancord and our partner teams across both offensive and defensive disciplines
• Communicate findings, detection coverage, and remediation guidance clearly to audiences ranging from system administrators to executive leadership
• Partner with the strategic consulting and customer success teams to ensure client needs are met and exceeded

Requirements:

• • Significant experience in cybersecurity with a strong emphasis on penetration testing. We are interested in skillset and expertise, not longevity in the field
• • A proven track record of independently leading penetration testing engagements and delivering valuable, actionable insights to clients
• • Hands on experience writing and tuning detection logic in a SIEM or EDR query language such as KQL, ES|QL, or EQL. Candidates should be able to walk through a detection they wrote, what it catches, what it misses, and how they tuned it
• • Working knowledge of SIEM, EDR, and SOAR platforms and of security telemetry generally, including tools such as Elastic, Sentinel, Defender, CrowdStrike, or SentinelOne
• • Proficiency in scripting and programming with Python, Bash, and PowerShell for automation, custom tooling, or exploit development
• • Deep experience with Windows and Linux or Unix operating systems, including advanced command line proficiency
• • Practical familiarity with MITRE ATT&CK as a working framework rather than a reference document
• • Ability to take an attacker technique, describe the observable artifacts it leaves behind, and explain how you would detect it and confirm the detection works. This is the bridge between the two halves of the role
• • Excellent communication and technical writing skills, with the ability to convey complex findings to diverse audiences
• • Strong problem-solving skills, attention to detail, and the ability to manage multiple engagements simultaneously
• • A track record of self-education, continuous improvement, and adaptability to evolving threats and technologies
• • Remote candidates must have a stable internet connection and a dedicated workspace for customer and internal meetings. Candidates will be expected to appear on camera during these meetings
• • Relevant offensive security certifications such as OSCP, OSCE, OSWE, GPEN, GXPN, CRTO, HTB CPTS, or similar advanced credentials
• • Direct experience with red team operations, adversary simulation, or purple team engagements
• • Detection as code experience, including version-controlled detection content, peer review of detection logic, CI/CD promotion pipelines, and automated testing of rules before production deployment
• • Experience building SOC automation through SOAR platforms and Python based tooling, including enrichment pipelines, ETL workflows, and data stream integrations
• • Experience developing threat intelligence driven detections or leading structured hunts
• • Experience supporting incident response engagements, including containment decisions and executive communication under pressure
• • Background in software development at any scale
• • Background managing server infrastructure, designing or deploying campus sized networks, or managing cloud infrastructure
• • Experience in an MSSP or MDR environment, including multi-tenant operations
• • Experience with presales, client facing consulting, or engagement scoping
• • Familiarity with SOC 2, ISO, NIST, CMMC, or HIPAA frameworks as they apply to client environments