Lead Offensive Security Researcher

GhostEye; New York (NY); On-site; USD 180,000 - 260,000; Full time

Job summary

GhostEye seeks a Lead Security Researcher to study how real adversaries move from human manipulation to technical compromise. You’ll spearhead attack-simulation platform, set technical direction, conduct research, build tooling, and ship capabilities across phishing, vishing, deepfakes, and post‑exploitation testing.

You’ll translate attacker tradecraft into safe, repeatable simulations, ensure defenses withstand real attacks, and mentor engineers while collaborating with product and security

Qualifications

• Proven ability to build offensive-security tools or attack simulations.
• Hands-on understanding of social engineering to endpoint compromise.
• Experience researching endpoint tradecraft, EDR behavior, and telemetry.
• Strong programming skills in Python, PowerShell, or C-family languages.

Responsibilities

• Study complete attack chain, combining OSINT, social engineering, identity attacks, endpoint execution, defense evasion, credential access, lateral movement, and C2.
• Build realistic attack simulations spanning phishing, vishing, smishing, deepfakes, pretexting, pen testing, and post‑exploitation activity.
• Lead the attack-simulation engineering team; set technical direction, translate research into engineering priorities, review implementation, mentor engineers, and ship capabilities.
• Advance endpoint and EDR validation; research endpoint tradecraft and EDR evasion, identify telemetry gaps, turn techniques into tests.
• Translate research into customer impact; analyze simulations and produce remediation guidance for customers.
• Build GhostEye’s research program; own the research roadmap and publish selected findings through writing and talks.

Skills

Python

PowerShell

C

C++

C#

Go

Rust

Automation

MITRE ATT&CK

Adversary-emulation

Leadership

Communication

Job description

GhostEye seeks a Lead Security Researcher to study how real adversaries move from human manipulation to technical compromise. You’ll spearhead attack-simulation platform, set technical direction, conduct research, build tooling, and ship capabilities across phishing, vishing, deepfakes, and post‑exploitation testing.

You’ll translate attacker tradecraft into safe, repeatable simulations, ensure defenses withstand real attacks, and mentor engineers while collaborating with product and security