Security Engineer II (Offensive Operations)

JobCubby; Boston, Northern (MA, KY); Hybrid; USD 99,000 - 120,000; Full time

Job summary

Flywire is seeking a Security Engineer II to bridge manual penetration testing with active security operations in a Hybrid Boston role. You will lead internal and external assessments across AWS/multicloud and test complex web apps and APIs to find high-risk issues, while guiding remediation with engineering teams.

You will review code and SAST/DAST results, participate in purple and red team activities, and help manage bug bounty programs and threat intel aligned to MITRE ATT&CK.

Qualifications

• Bachelor of Science in IT security or related field.
• 2+ years in IT security and penetration testing.
• Proficiency with offensive security tools, scripting languages, and cloud infrastructure.
• Experience with cloud and web application/API pentesting.

Responsibilities

• Conduct manual internal and external penetration testing across AWS/multicloud environments to identify vulnerabilities, misconfigurations, and privilege escalation paths.
• Perform deep-dive testing on web applications and REST/GraphQL APIs, targeting complex business logic flaws, auth bypasses, and OWASP Top 10 risks.
• Review SAST/DAST findings and conduct targeted code audits (Python, Java, Ruby) to eliminate false positives and prioritize high-risk fixes.
• Purple Team Operations: Partner with the Blue Team during adversary emulation exercises to validate security controls, refine enterprise SIEM detection rules, and optimize real-time alerting.
• Red Team Engagements: Participate in goal-oriented adversarial simulations evaluating Flywire's physical/digital posture and incident response readiness.
• Bug Bounty Operations: Manage external vulnerability disclosure and bug bounty programs, triaging submissions, validating severity, and coordinating swift engineering fixes.
• Threat Intelligence (MITRE ATT&CK): Apply emerging threat actor TTPs to continuously align testing methodologies with the MITRE ATT&CK framework.
• Collaborative Advisory: Deliver actionable remediation guidance to Engineering, SRE, and IT teams, balancing robust security fixes with business velocity.

Skills

Kali Linux

Penetration testing

Cloud security

Web API testing

Python/Java/Ruby scripting

SAST/DAST tools

AWS / Cloud infrastructure

CI/CD & IaC

MITRE ATT&CK

Bug bounty platforms

Education

Bachelor of Science in IT Security

Tools

Kali Linux

Burp Suite

OWASP ZAP

Nessus

Job description

to apply - email only, no card. You can also save this posting or score it againstyour profile with AI.## About the roleThe Security Engineer will execute manual penetration testing across cloud and web environments while partnering with the Blue Team for adversary emulation. They will also manage bug bounty programs and provide actionable remediation guidance to engineering teams.## RequirementsCandidates must have a Bachelor of Science degree and at least 2 years of experience in IT security and penetration testing. Proficiency in offensive security tools, scripting languages, and cloud infrastructure is required.## Full descriptionCompany DescriptionPassion, excitement & global collaboration are all core to what it means to be a FlyMate. At Flywire, we're on a mission to deliver the world's most important and complex payments. We use our Flywire Advantage - the combination of our next-gen payments platform, proprietary payment network and vertical specific software, to help our clients get paid, and help their customers pay with ease - no matter where they are in the world.Who we are:Flywire is a global payments enablement and software company, founded more than a decade ago to solve high-stakes, high-value payments in higher education. We've since scaled into new regions and industry verticals and expanded our product offerings to deliver meaningful value to our clients around the world.Today we support more than 5,300 clients across the global education, healthcare, travel & B2B industries, with diverse payment methods across 240 countries & territories and more than 140 currencies.With over 1,400 global FlyMates, representing more than 40 nationalities, and in 15 offices world-wide, we're looking for FlyMates to join the next stage of our journey as we continue to grow.Job DescriptionAs a Security Engineer II on our Active Operational Offensive track, you'll sit at the heart of Flywire's security defenses under the guidance of senior engineers. You will bridge manual penetration testing with active security operations, building the technical depth needed to lead independent engagements over time.Key Responsibilities & Impact* Cloud Infrastructure PenTesting: Execute manual internal and external penetration testing across AWS/multicloud environments to identify vulnerabilities, misconfigurations, and privilege escalation paths.* Web Application & API Assessment: Perform deep-dive testing on web applications and REST/GraphQL APIs, targeting complex business logic flaws, auth bypasses, and OWASP Top 10 risks.* Source Code & Vulnerability Analysis: Review SAST/DAST findings and conduct targeted code audits (Python, Java, Ruby) to eliminate false positives and prioritize high-risk fixes.* Purple Team Operations: Partner with the Blue Team during adversary emulation exercises to validate security controls, refine enterprise SIEM detection rules, and optimize real-time alerting.* Red Team Engagements: Participate in goal-oriented adversarial simulations evaluating Flywire's physical/digital posture and incident response readiness.* Bug Bounty Operations: Manage external vulnerability disclosure and bug bounty programs, triaging submissions, validating severity, and coordinating swift engineering fixes.* Threat Intelligence (MITRE ATT&CK): Apply emerging threat actor TTPs to continuously align testing methodologies with the MITRE ATT&CK framework.* Collaborative Advisory: Deliver actionable remediation guidance to Engineering, SRE, and IT teams, balancing robust security fixes with business velocity.QualificationsHere's What We're Looking For:* Education & Experience: Bachelor of Science and at least 2+ years' experience in IT security and Penetration Testing.* Hands-on PenTesting: Demonstrated track record executing network, web application, and API penetration tests.* Offensive Toolset: Proficiency with Kali Linux, commercial/open-source penetration tools, and active involvement on bug bounty platforms.* Code & Automation: Experience with SAST/DAST tools, secure code reviews, and scripting knowledge in Python, Java, or Ruby.* Modern Stack Exposure: Understanding of AWS Cloud infrastructure, Agile environments, CI/CD pipelines, and Infrastructure as Code (IaC).* Security Frameworks: Strong knowledge of OWASP methodologies, threat vectors (malware, intrusion, DoS), and platform security strategies.* High-Impact Communication: Ability to write formal/informal technical reports and translate complex exploit chains to non-technical stakeholders.Preferred Certifications (Nice-to-Have):* Offensive & Red Team: OSCP, OSCE, or SANS GXPN.* AI Security: OffSec OSAI (Offensive Security AI Red Teamer).Mindset & Soft Skills:* Dual Focus: Combines an attacker's drive to break systems with a defender's discipline to build actionable SIEM detection rules.* Composure Under Pressure: Analytical and calm during live security breaches or tight release windows.* Business-Minded Security: Balances risk mitigation with organizational growth.Additional InformationSubmit today and get started!We are excited to get to know you! Throughout our process you can expect to meet different FlyMates including the Hiring Manager and other Flymates. Your Talent Acquisition Partner will walk you through the steps and be your \"go-to\" person for questions.Flywire is an equal opportunity employer and follows a policy of administering all employment decisions and personnel actions without regard to race, color, religion, sex, pregnancy, gender identity, national origin, age, ancestry, physical or mental disability, sexual orientation, genetic disposition or carrier status, veteran status, or any other category protected under applicable national, federal, state or local law.The US base salary range for this full-time position is $99,000 - 120,000 and benefits. Our salary ranges are determined by role, position level, and location. The range displayed on this job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. Within the range, individual pay is determined by work location and several other factors, including job-related skills, experience, relevant education and training.#LI-Hybrid