Security Engineer, Offensive Security

Liftoff; Sacramento (CA); Presencial; USD 184.000 - 250.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Medical coverage

Wellness stipends

Country-based perks

Descripción de la vacante

Liftoff is a leading AI-powered performance marketing platform for the mobile app economy, seeking a Security Engineer, Offensive Security. The role covers internal penetration testing across applications, APIs, cloud infrastructure, and corporate systems, with an emphasis on automated, AI-assisted workflows.

Responsibilities include testing scope definition with system owners, risk-based prioritization, code review, and collaboration with engineering to remediate findings.

Formación

• 5+ years of relevant security engineering experience, including substantial hands-on penetration testing of applications and infrastructure.
• Write production-quality code for security tools and automation, review pull requests, and navigate large, unfamiliar codebases.

Responsabilidades

• Independently plan and execute internal penetration tests across applications, APIs, cloud infrastructure, and corporate systems; prioritize assessments by risk and business impact.
• Define testing scope and rules of engagement with system owners, assess production risk, and choose safe methods for validating vulnerabilities.
• Combine hands-on testing with source-code review and architectural analysis to find vulnerabilities and demonstrate realistic attack paths.
• Partner with engineering teams to explain findings, agree on practical fixes, track remediation, and retest to confirm the risk is resolved.
• Maintain knowledge of Liftoff's systems and attack surface, revisit high-risk attack paths as systems change, and turn confirmed findings into repeatable tests.
• Make security testing self-service where practical through reusable tests, documented assessment and retesting workflows, and clear remediation guidance.
• Support the annual third-party penetration test for independent validation and customer and audit requirements; Lead adoption of AI-assisted offensive security tooling: evaluate platforms and build workflows for code analysis, test generation, and finding triage; Work across application, cloud, and infrastructure security as priorities change, including Accelerate and MX, and share the team's on-call and incident-response rotation, including occasional off-hours response and post-incident follow-up.

Conocimientos

Security engineering

Risk prioritization

Code review

Go / Python / JS

Cloud security

Technical writing

Attack surface

Herramientas

Go

Python

Clojure

JavaScript

Descripción del empleo

Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize revenue across programmatic and direct demand. Liftoff's solutions, including Accelerate, Direct, Monetize, Intelligence, and Vungle Exchange, support over 6,600 mobile businesses across 74 countries in sectors such as gaming, social, finance, ecommerce, and entertainment. The Liftoff Security team protects Liftoff's customers, users, and employees. We architect Liftoff's security posture, build the tools and systems that defend it, and partner with engineering teams as they ship new products and features. Our work spans the entire stack — infrastructure, web, mobile, and IT — and we approach security from a software engineering standpoint, scaling our impact through automation and well-designed tools. As our Security Engineer, Offensive Security, you will own internal offensive testing and lead the move from point-in-time penetration tests to continuous, AI-assisted testing. You will contribute across application, cloud, and infrastructure security, support Accelerate and MX as priorities change, and share the team's on-call and incident-response work.

Responsibilities

• Independently plan and execute internal penetration tests across applications, APIs, cloud infrastructure, and corporate systems; prioritize assessments by risk and business impact.
• Define testing scope and rules of engagement with system owners, assess production risk, and choose safe methods for validating vulnerabilities.
• Combine hands‑on testing with source-code review and architectural analysis to find vulnerabilities and demonstrate realistic attack paths.
• Partner with engineering teams to explain findings, agree on practical fixes, track remediation, and retest to confirm the risk is resolved.
• Maintain knowledge of Liftoff's systems and attack surface, revisit high-risk attack paths as systems change, and turn confirmed findings into repeatable tests.
• Make security testing self‑service where practical through reusable tests, documented assessment and retesting workflows, and clear remediation guidance.
• Support the annual third‑party penetration test for independent validation and customer and audit requirements; Lead adoption of AI‑assisted offensive security tooling: evaluate platforms and build workflows for code analysis, test generation, and finding triage; Work across application, cloud, and infrastructure security as priorities change, including Accelerate and MX, and share the team's on‑call and incident‑response rotation, including occasional off‑hours response and post‑incident follow‑up.

Qualifications

• 5+ years of relevant security engineering experience, including substantial hands‑on penetration testing of applications and infrastructure.
• Excellent judgment in prioritizing testing by risk, assessing production impact, and safely validating exploits without unnecessary disruption.
• Write production‑quality code for security tools and automation, review pull requests, and navigate large, unfamiliar codebases. Develop safe proof‑of‑concept code and independently validate AI‑generated code and findings.
• Strong understanding of application and API security, authentication and authorization, network security, and common vulnerability classes.
• Hands‑on experience assessing cloud and infrastructure security, including identity and access controls, configuration, and attack paths.
• Ability to quickly understand complex systems and architecture and contribute across application, cloud, and infrastructure security.
• Practical software engineering habits: testing, observability, version control, peer code review, continuous integration, and blameless postmortems.
• Strong technical writing: clear assessment plans, proposals, reproducible findings, runbooks, and post‑incident reviews that support engineering decisions. Explain exploitability and business impact clearly in writing and conversation.
• Experience with Go, Python, Clojure, or JavaScript; ability to work across languages matters more than a specific language.
• Experience building AI‑assisted security testing workflows and measuring the accuracy and usefulness of their results.
• Experience securing large‑scale cloud systems, mobile advertising, or other high‑volume SaaS environments.
• Build and own our in‑house offensive security capability, from selecting assessments to confirming fixes.
• Test applications, APIs, cloud infrastructure, and corporate systems with access to source code and engineering context.
• Engineering Partnership : Work with teams that value security and stay involved through remediation and retesting.
• Room to Grow : Move from point‑in‑time penetration tests to continuous testing and lead adoption of AI‑assisted offensive security tools.
• Hands‑On Technical Work: Investigate complex systems, validate vulnerabilities safely, and build tools that make testing more effective.

Locations and Compensation

SF Bay Area, Los Angeles/Orange County, NYC, Seattle : $200,000 - $250,000 plus bonus

184,000 - $220,000 plus bonus

Liftoff's compensation strategy includes competitive salaries, equity, and benefits designed to support employee well‑being and performance.

Benefits

• Benefits may include medical coverage, wellness stipends, and additional perks based on your country of residence.

Company Culture

We're shaping the future of the mobile app ecosystem—join us and help accelerate what's next.

We are committed to creating an inclusive environment for all employees and applicants regardless of race, ethnicity, national origin, age, marital status, disability, sexual orientation, gender identity, religion, veteran status, or any other characteristic protected by applicable law.