Lead Engineer Offensive Security

Optimum; Plano (TX); Hybride; USD 180 000 - 240 000; Plein temps

Résumé du poste

Optimum is seeking a Lead Offensive Security Engineer to join our Product Security team in Plano. You will be a founding member responsible for attacking our products—web, APIs, mobile, IoT, SaaS, and AI systems—and building the tooling and workflows to scale this capability.

You will set strategy, prove the model, and establish standards for the engineers who join you. This role emphasizes self-direction, bold execution, and tight collaboration with security and product teams.

Qualifications

• 10+ years in security engineering, incl. 5+ years hands-on offensive security.
• Founding/first-in-hire experience building an offensive security/red team function.
• Self-directed, able to operate with minimal supervision and set technical direction.

Responsabilités

• Lead threat-led assessments and penetration tests across web, API, mobile, IoT, and SaaS products.
• Design and execute red team operations against product environments.
• Build and scale an offensive security program with standard methodologies and tooling.
• Develop AI-driven offensive capabilities and supporting internal tooling and automation.

Connaissances

Security engineering

Offensive security

Penetration testing

Red teaming

Threat modeling

AI-native workflow

Coding with agents/LLMs

Python

Go

C/C++

Formation

Technical degree or equivalent experience

Outils

Python

Go

C/C++

TypeScript

Rust

Description du poste

Select how often (in days) to receive an alert:

Location:

Plano, TX, US, 75024

Brand: Optimum

Requisition #: 12568

Are you looking to Optimize your life? Start your exciting path to a rewarding career today!

We are Optimum, a leader in the fast-paced world of connectivity, and we're seeking driven and enthusiastic professionals to join our team, empower lives, fuel businesses, and drive innovation. Connectivity is no longer a luxury, but a necessity. A career at Optimum means you'll be enabling progress and enhancing lives by providing reliable, high-speed connectivity solutions that keep the world connected. Our successes, now and in the future, are powered by our amazing product, a commitment to our people and culture, and the connections we make in our communities.

If you are resourceful, collaborative, and passionate about delivering consistent excellence, Optimum is for you!

Job Summary

The Product Security organization helps Optimum move faster, securely. We're a team of engineers who work to enable other teams to build products as quickly as possible while continuing to protect our customers. We support developers in shipping secure code by building security tools and services, providing security training and expertise, and advocating for best practices in authentication, authorization, and safe data handling across the company.

As the Lead Offensive Security Engineer, you will be a founding member of Optimum's Product Offensive Security team. This is a hands-on role with a build mandate. You will personally attack our products, including software applications, APIs, mobile, IoT and embedded devices, SaaS platforms, and the AI systems and models increasingly embedded in them. You will also build the methodology, tooling, and AI agent workflows that turn that work into a durable, scaling capability.

The charter spans four connected disciplines: threat-led security assessments, penetration testing, product red teaming, and offensive AI engineering. Our focus is the products our customers touch rather than corporate infrastructure. We measure success by risk reduced and time-to-test collapsed, not by findings delivered.

This role is built for a self-directed, low-overhead operator who ships outcomes without hand-holding, treats AI as a native part of their daily workflow, and is energized by being the first to build something new. You will set the strategy, prove the model, and establish the standards and tooling that the engineers we hire behind you will run on.

Responsibilities

• Security Assessments
• Stand up and scale the product security assessment function from zero, including the intake, scoping, and triage model that decides which products get assessed and at what depth.
• Lead threat-led assessments of new, existing, and acquired products, reasoning about trust boundaries, authorization models, and data flows to find design flaws dynamic testing misses. On high-risk launches, run them early enough to change designs, not ship dates.
• Reduce our dependency on third-party testing engagements for low and moderate-risk applications.
• Automate the repeatable parts: data collection, threat model generation, control validation, and finding triage, so human judgment goes to the flaws that need it.
• Plan, scope, and execute hands-on penetration tests across applications (web, API, mobile), IoT and embedded devices, multi-tenant SaaS, product cloud environments, and AI systems (LLMs, agents, ML pipelines).
• Produce prioritized, reproducible findings with remediation guidance engineers act on, and set the methodology, rules of engagement, and quality bar for the function.

3. Product Red Team

• Design and execute objective-based red team operations against product environments, using emulation plans grounded in telecom threat intelligence, in partnership with detection and response.
• Conduct adversarial testing of AI systems: prompt injection, model evasion, data poisoning, model extraction, agent and tool abuse, and AI supply chain attacks.
• Build and operate an AI-driven offensive capability, orchestrating commercial and open-source agents to cut time-to-test and cost-to-test, including continuous autonomous testing of high-value applications against a defined quality bar.
• Build internal tooling and automation across the lifecycle, from recon through reporting and remediation tracking, that turns one-off engagements into durable capability.

5. Program and Partnership

• Partner across the security organization to feed findings into threat models and secure-by-default guardrails, define the metrics that show whether this function is working, and set technical direction for the engineers who join it.

Qualifications

• 10+ years in security engineering, including 5+ years hands-on offensive security across penetration testing, red teaming, assessment, or vulnerability research, or equivalent demonstrated capability. Technical degree or equivalent experience.
• Experience as a founding or first-in-discipline hire, building an offensive security or red team function from zero, including methodology and tooling that outlast your own engagements.
• Demonstrated self-direction: scoping your own work, managing your own pipeline, delivering without close supervision, and setting technical direction for other engineers.
• AI-native working style, with fluent daily use of LLMs and coding agents and concrete examples of how they multiplied your output as a tester.
• Deep, hands-on expertise testing modern web applications, APIs, and mobile, including authentication, authorization, session management, and business logic flaws.
• Experience testing IoT and embedded devices (firmware, UART, JTAG/SWD, SPI/I2C), multi-tenant SaaS (tenant isolation, OAuth/SAML), and container and CI/CD pipeline attacks.
• Working knowledge of applied cryptography, key management, and common cryptographic failure modes.
• Proven ability to lead threat modeling and architecture review, decomposing systems into trust boundaries, authorization models, and data flows to find design-level flaws.
• Experience building or scaling an assessment program: standardizing methodology, defending risk-based prioritization to leadership, and shifting coverage in-house without reducing assurance.
• Hands-on experience planning and executing objective-based red team operations under formal rules of engagement, working with detection and response to translate tradecraft into coverage.
• Hands-on adversarial testing of AI/ML systems (prompt injection, jailbreaks, model evasion, supply chain and agent abuse) aligned to OWASP LLM Top 10 and MITRE ATLAS, with a realistic view of what autonomous offensive platforms can do today.
• Ability to build offensive tooling, not just consume commercial scanners. Comfortable writing exploits, harnesses, and pipelines in Python, Go, and one of C/C++, TypeScript, or Rust.
• Excellent written and verbal communication: findings engineers act on, and briefings that land with technical and non-technical leadership. Builds trust with engineering by partnering on fixes.

Preferred Qualifications

• Operating autonomous penetration testing platforms in production, or building agentic offensive tooling for recon, exploitation, or triage.
• Original vulnerability research, CVEs, public exploits, contributions to offensive open-source tooling, or a bug bounty track record.
• Telecom or service provider experience testing DOCSIS, PON, Wi-Fi, mobile, or video product ecosystems.
• Active or previously held US government security clearance, or experience in restricted or trusted-access environments (cleared programs, export-controlled work, CALEA-adjacent systems).
• Conference talks, papers, or training (DEF CON, Black Hat, USENIX Security, OffensiveCon), or certifications such as OSCP, OSEP, OSEE, or GIAC GXPN.

At Optimum, every action and interaction we take part in, is driven by our three Guiding Principles: Do What's Right, Drive One Optimum, and Make It Happen. These aren't just words, they help us build trust, create real community, and embrace new ways of thinking. Our employees are empowered to do the right thing for our customers and co-workers and to recognize and reward these behaviors when we see them. It's all part of the bigger picture of "Be The Difference" where each employee knows they have the power to enact real change, share new ideas, and understand that learning never stop.

If you have the drive to succeed and are ready to embark on a thrilling career, seize this opportunity today, and join our winning team. Together, we'll shape the future of connectivity.

All job descriptions and required skills, qualifications and responsibilities for a particular position are subject to modification by the Company from time to time, in the Company's discretion based on business necessity.

We are an Equal Opportunity Employer committed to recruiting, hiring and promoting qualified people of all backgrounds regardless of gender, race, color, creed, national origin, religion, age, marital status, pregnancy, physical or mental disability, sexual orientation, gender identity, military or veteran status, or any other basis protected by federal, state, or local law.

The Company collects personal information about its applicants for employment that may include personal identifiers, professional or employment related information, photos, education information and/or protected classifications under federal and state law. This information is collected for employment purposes, including identification, work authorization, FCRA-compliant background screening, human resource administration and compliance with federal, state and local law.

Applicants for employment with The Company will never be asked to provide money (even if reimbursable) as part of the job application or hiring process. Please review our Fraud FAQ for further details.

Sponsorship Language (Remove if Sponsorship is Available)
We appreciate your interest in this opportunity. Applicants must be authorized to work for ANY employer in the U.S. Please note that at this time, we do not provide visa sponsorship for employment.

Nearest Major Market: Plano
Nearest Secondary Market: Dallas