Security Engineer II: Offensive Pen Testing & Purple Team

Flywire1; Boston (MA); Hybrid; USD 99,000 - 120,000; Full time

Job summary

Flywire is seeking a Security Engineer II on the Active Operational Offensive track to join our security team in Boston. You will bridge manual penetration testing with active security operations, building depth to lead engagements.

The role requires hands-on pentesting across AWS/multicloud, web apps, APIs, code reviews, and collaboration with Blue/Red teams to improve detections and incident readiness. You will triage bug bounties, apply MITRE ATT&CK, and translate complex exploits into

Qualifications

• Bachelor of Science and 2+ years' IT security and penetration testing experience.
• Hands-on pen-testing across network, web app, and API.
• Experience with offensive toolsets and bug bounty platforms.
• Scripting knowledge in Python/Java/Ruby.
• Familiar with AWS and CI/CD/IaC.
• Knowledge of OWASP and threat vectors.
• Strong written and verbal communication.

Responsibilities

• Perform manual internal and external penetration testing across AWS/multicloud.
• Assess web applications and REST/GraphQL APIs for logic flaws and auth bypasses.
• Review SAST/DAST findings and perform targeted code audits.
• Collaborate with the Blue Team during purple team exercises.
• Participate in red team engagements and bug bounty triage.
• Apply MITRE ATT&CK to testing methodologies.
• Provide remediation guidance to Engineering, SRE, and IT teams.

Skills

Penetration Testing

Kali Linux

Scripting (Python/Java/Ruby)

Cloud & Multi-cloud

OWASP & Security Frameworks

Threat Communication

Education

Bachelor's degree in IT security

Tools

Penetration testing tools

SAST/DAST tools

Job description

Flywire is seeking a Security Engineer II on the Active Operational Offensive track to join our security team in Boston. You will bridge manual penetration testing with active security operations, building depth to lead engagements.

The role requires hands-on pentesting across AWS/multicloud, web apps, APIs, code reviews, and collaboration with Blue/Red teams to improve detections and incident readiness. You will triage bug bounties, apply MITRE ATT&CK, and translate complex exploits into