Security Engineer II - Pen Testing, Bug Bounty & Blue Team

JobCubby; Boston, Northern (MA, KY); Hybrid; USD 99,000 - 120,000; Full time

Job summary

Flywire is seeking a Security Engineer II to bridge manual penetration testing with active security operations in a Hybrid Boston role. You will lead internal and external assessments across AWS/multicloud and test complex web apps and APIs to find high-risk issues, while guiding remediation with engineering teams.

You will review code and SAST/DAST results, participate in purple and red team activities, and help manage bug bounty programs and threat intel aligned to MITRE ATT&CK.

Qualifications

• Bachelor of Science in IT security or related field.
• 2+ years in IT security and penetration testing.
• Proficiency with offensive security tools, scripting languages, and cloud infrastructure.
• Experience with cloud and web application/API pentesting.

Responsibilities

• Conduct manual internal and external penetration testing across AWS/multicloud environments to identify vulnerabilities, misconfigurations, and privilege escalation paths.
• Perform deep-dive testing on web applications and REST/GraphQL APIs, targeting complex business logic flaws, auth bypasses, and OWASP Top 10 risks.
• Review SAST/DAST findings and conduct targeted code audits (Python, Java, Ruby) to eliminate false positives and prioritize high-risk fixes.
• Purple Team Operations: Partner with the Blue Team during adversary emulation exercises to validate security controls, refine enterprise SIEM detection rules, and optimize real-time alerting.
• Red Team Engagements: Participate in goal-oriented adversarial simulations evaluating Flywire's physical/digital posture and incident response readiness.
• Bug Bounty Operations: Manage external vulnerability disclosure and bug bounty programs, triaging submissions, validating severity, and coordinating swift engineering fixes.
• Threat Intelligence (MITRE ATT&CK): Apply emerging threat actor TTPs to continuously align testing methodologies with the MITRE ATT&CK framework.
• Collaborative Advisory: Deliver actionable remediation guidance to Engineering, SRE, and IT teams, balancing robust security fixes with business velocity.

Skills

Kali Linux

Penetration testing

Cloud security

Web API testing

Python/Java/Ruby scripting

SAST/DAST tools

AWS / Cloud infrastructure

CI/CD & IaC

MITRE ATT&CK

Bug bounty platforms

Education

Bachelor of Science in IT Security

Tools

Kali Linux

Burp Suite

OWASP ZAP

Nessus

Job description

Flywire is seeking a Security Engineer II to bridge manual penetration testing with active security operations in a Hybrid Boston role. You will lead internal and external assessments across AWS/multicloud and test complex web apps and APIs to find high-risk issues, while guiding remediation with engineering teams.

You will review code and SAST/DAST results, participate in purple and red team activities, and help manage bug bounty programs and threat intel aligned to MITRE ATT&CK.