Red Team Security Engineer — AI-Powered Offensive Testing

Whatnot Inc.; San Francisco, Los Angeles, New York, Seattle (CA, CA, NY, WA); Remoto; USD 150.000 - 210.000; Tempo pieno

Vantaggi offerti da questo lavoro

Generous Holiday and Time off Policy

Health Insurance options

Work From Home Support

Home office setup allowance

Monthly allowance for cell phone and  

Monthly allowance for internet

Care benefits

Annual childcare allowance

Lifetime family planning benefit

401k employer match up to 4%

Dogfooding budget

Parental leave 16 weeks

Descrizione del lavoro

Whatnot Inc. seeks a Red Team Engineer to identify weaknesses in cloud, networks, IAM, Kubernetes, and CI/CD environments. You will build AI-assisted testing harnesses, emulate adversaries using MITRE ATT&CK, and drive purple team exercises with detection engineering.

You’ll document findings with reproducible steps, measure impact, and drive remediation through to closure, while developing robust Python tooling and clear reports for engineers and leadership.

Competenze

• 3+ years in offensive security, red teaming, or penetration testing against production-scale environments.
• Strong programming skills in Python; you build your own tooling rather than relying on others.
• Hands-on experience building LLM-powered workflows or agents (tool use, orchestration, evaluation, guardrails).
• Deep knowledge in cloud security and IAM abuse, Kubernetes/container escapes, web/API exploitation, CI/CD/supply chain attacks.
• Working knowledge of AI-specific risks: prompt injection, data leakage, excessive agent permissions, model supply chain issues.
• Sound judgment on scope, safety, and blast radius; test production-adjacent systems without outages.
• Clear written communication: reports engineers can act on and executives can skim.

Mansioni

• Plan and run authorized red team operations across cloud, Kubernetes, networks, identity systems, SaaS, and internal applications.
• Build and maintain AI-assisted testing harnesses and agent loops for recon, attack-path discovery, fuzzing, and exploit validation with proper controls.
• Use LLMs and agentic tools to speed up vulnerability research, payload generation, code review, and report drafting.
• Red team our own AI systems: prompt injection, tool/connector abuse, data exfiltration, and supply chain risk in AI dependencies.
• Emulate adversaries using MITRE ATT&CK and ATLAS, chaining findings into end-to-end attack paths.
• Run purple team exercises with detection engineering and incident response; tune detections based on evasion.
• Write clear findings with reproducible steps, impact, and fixes; track remediation to closure and retest.
• Automate regression tests so fixed weaknesses stay fixed; feed results into CI/CD pipelines.
• Document and share techniques, tooling, and lessons learned with engineering teams.
• Collaborate with Whatnot's Blue Team on Purple Team engagements to strengthen security posture.

Conoscenze

Python programming

Offensive security

LLM workflows

Cloud security

Kubernetes

Identity attacks

CI/CD security

Written communication

Strumenti

Python tooling

MITRE ATT&CK

Descrizione del lavoro

Whatnot Inc. seeks a Red Team Engineer to identify weaknesses in cloud, networks, IAM, Kubernetes, and CI/CD environments. You will build AI-assisted testing harnesses, emulate adversaries using MITRE ATT&CK, and drive purple team exercises with detection engineering.

You’ll document findings with reproducible steps, measure impact, and drive remediation through to closure, while developing robust Python tooling and clear reports for engineers and leadership.