Offensive Security Lead: AI-Driven Red Team & Pentest

SoFi; Frisco (TX); On-site; USD 150,000 - 240,000; Full time

Job summary

SoFi is seeking an Offensive Security Lead to mature our Penetration Testing and Red Team functions. This hands-on leadership role combines technical execution with program strategy, staffing, and tooling decisions.

You will drive AI-assisted testing programs, define KPIs, and partner with engineering, product, and risk teams to deliver measurable security improvements while aligning with regulatory requirements.

Qualifications

• 8+ years in offensive security, with hands-on penetration testing and red team work.
• 2+ years directly managing offensive security teams in regulated environments.
• Proven experience designing and implementing AI-led or AI-assisted programs.
• Fluency across network, web/app, cloud (AWS/GCP/Azure) and mobile attack surfaces; familiarity with ATT&CK and C2 tooling.
• Track record of building or maturing programs with process, tooling, metrics and team structure.

Responsibilities

• Lead Penetration Testing and Red Team as a unified Offensive Security function.
• Define and execute the offensive security roadmap and engagement cadence.
• Build AI-augmented capabilities, tooling, and workflows to scale coverage and throughput.
• Lead engagements across network, app, cloud, and adversary emulation.
• Manage, coach, and grow penetration testers and red team operators.

Skills

Offensive security

Team leadership

AI-assisted security

Regulated industry

Threat emulation

Cloud security

Penetration testing

Red team

Education

OSCP/OSCE/OSEP/GPEN/GXPN/CRTO

Tools

AI tooling

MITRE ATT&CK

C2 tooling

Job description

SoFi is seeking an Offensive Security Lead to mature our Penetration Testing and Red Team functions. This hands-on leadership role combines technical execution with program strategy, staffing, and tooling decisions.

You will drive AI-assisted testing programs, define KPIs, and partner with engineering, product, and risk teams to deliver measurable security improvements while aligning with regulatory requirements.