Lead Offensive Security Engineer - Product Security Innovator

Optimum; Plano (TX); On-site; USD 180,000 - 260,000; Full time

Job summary

Optimum is seeking a Lead Offensive Security Engineer to build and lead the Product Offensive Security team. You will personally attack products—web, API, mobile, IoT, and AI systems—while establishing standards, tooling, and a scalable workflow for a new security function.

You will define strategy, demonstrate value, and guide engineers who join this mission. You will work in a hands-on role with a focus on threat-led assessments, red teaming, and offensive AI engineering, measuring success by

Qualifications

• 10+ years in security engineering, including 5+ years hands-on offensive security across penetration testing, red teaming, assessment, or vulnerability research, or equivalent demonstrated capability.
• Experience as a founding or first-in-discipline hire, building an offensive security or red team function from zero, including methodology and tooling that outlast your own engagements.
• Demonstrated self-direction: scoping your own work, managing your own pipeline, delivering without close supervision, and setting technical direction for other engineers.
• AI-native working style, with fluent daily use of LLMs and coding agents and concrete examples of how they multiplied your output as a tester.
• Deep, hands-on expertise testing modern web applications, APIs, and mobile, including authentication, authorization, session management, and business logic flaws.
• Experience testing IoT and embedded devices (firmware, UART, JTAG/SWD, SPI/I2C), multi-tenant SaaS (tenant isolation, OAuth/SAML), and container and CI/CD pipeline attacks.
• Working knowledge of applied cryptography, key management, and common cryptographic failure modes.
• Proven ability to lead threat modeling and architecture review, decomposing systems into trust boundaries, authorization models, and data flows to find design-level flaws.
• Experience building or scaling an assessment program: standardizing methodology, defending risk-based prioritization to leadership, and shifting coverage in-house without reducing assurance.
• Hands-on experience planning and executing objective-based red team operations under formal rules of engagement, working with detection and response to translate tradecraft into coverage.
• Hands-on adversarial testing of AI/ML systems (prompt injection, jailbreaks, model evasion, supply chain and agent abuse) aligned to OWASP LLM Top 10 and MITRE ATLAS, with a realistic view of what autonomous offensive platforms can do today.
• Ability to build offensive tooling, not just consume commercial scanners. Comfortable writing exploits, harnesses, and pipelines in Python, Go, and one of C/C++, TypeScript, or Rust.
• Excellent written and verbal communication: findings engineers act on, and briefings that land with technical and non-technical leadership. Builds trust with engineering by partnering on fixes.

Responsibilities

• Security Assessments
• Stand up and scale the product security assessment function from zero, including the intake, scoping, and triage model that decides which products get assessed and at what depth.
• Lead threat-led assessments of new, existing, and acquired products, reasoning about trust boundaries, authorization models, and data flows to find design flaws dynamic testing misses. On high-risk launches, run them early enough to change designs, not ship dates.
• Reduce our dependency on third‑party testing engagements for low and moderate‑risk applications.
• Automate the repeatable parts: data collection, threat model generation, control validation, and finding triage, so human judgment goes to the flaws that need it.
• Plan, scope, and execute hands‑on penetration tests across applications (web, API, mobile), IoT and embedded devices, multi‑tenant SaaS, product cloud environments, and AI systems (LLMs, agents, ML pipelines).
• Produce prioritized, reproducible findings with remediation guidance engineers act on, and set the methodology, rules of engagement, and quality bar for the function.
• 3. Product Red Team
• Design and execute objective‑based red team operations against product environments, using emulation plans grounded in telecom threat intelligence, in partnership with detection and response.
• Conduct adversarial testing of AI systems: prompt injection, model evasion, data poisoning, model extraction, agent and tool abuse, and AI supply chain attacks.
• Build and operate an AI‑driven offensive capability, orchestrating commercial and open‑source agents to cut time‑to‑test and cost‑to‑test, including continuous autonomous testing of high‑value applications against a defined quality bar.
• Build internal tooling and automation across the lifecycle, from recon through reporting and remediation tracking, that turns one‑off engagements into durable capability.
• 5. Program and Partnership
• Partner across the security organization to feed findings into threat models and secure‑by‑default guardrails, define the metrics that show whether this function is working, and set technical direction for the engineers who join it.

Skills

Offensive security

Penetration testing

Red teaming

Threat modeling

AI/ML security

Security tooling

Python

Go

C/C++

TypeScript

Rust

Excellent communication

Education

Technical degree or equivalent experience

Tools

Python

Go

C/C++

TypeScript

Rust

Job description

Optimum is seeking a Lead Offensive Security Engineer to build and lead the Product Offensive Security team. You will personally attack products—web, API, mobile, IoT, and AI systems—while establishing standards, tooling, and a scalable workflow for a new security function.

You will define strategy, demonstrate value, and guide engineers who join this mission. You will work in a hands-on role with a focus on threat-led assessments, red teaming, and offensive AI engineering, measuring success by