Lead Offensive Security Engineer — Real-World Pen Testing

Parameter; San Francisco (CA); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Parameter builds AI agents that perform offensive security work, running autonomous penetration tests against production apps and cloud environments to find IDORs, broken access control, XSS, and misconfigurations.

As a member of a small team, you’ll turn your methodology into agent capabilities, lead customer engagements, and contribute to vulnerability research while working onsite in San Francisco.

Qualifications

• 3+ years of hands-on offensive security: web app pentesting, red teaming, or bug bounty work.
• Deep knowledge of web vulnerability classes, especially access control, authentication, and business logic flaws.
• Cloud security experience across AWS or GCP: IAM, misconfiguration, escalation paths.
• You write code and build your own tooling; we care about what you build.
• Ability to write clearly for engineers and executives; unclear findings won’t get fixed.
• Bonus: OSCP, OSWE, CVEs, bug bounty leaderboard, talks.

Responsibilities

• Run manual penetration tests against customer web applications, APIs, and cloud infrastructure.
• Translate your methodology into agent capabilities: new attack modules, detection logic, and verification steps.
• Validate and triage agent findings before they reach customers; you are the quality bar.
• Lead the technical side of customer engagements, including scoping calls and findings walkthroughs.
• Contribute to vulnerability research and responsible disclosure work, a core part of our market approach.

Skills

Web pentesting

Red teaming

Bug bounty

Cloud security

Tools

TypeScript

Job description

Parameter builds AI agents that perform offensive security work, running autonomous penetration tests against production apps and cloud environments to find IDORs, broken access control, XSS, and misconfigurations.

As a member of a small team, you’ll turn your methodology into agent capabilities, lead customer engagements, and contribute to vulnerability research while working onsite in San Francisco.