Security Engineer, Red Team

Whatnot Inc.; United States; Remote; USD 140,000 - 200,000; Full time

Benefits offered by this job

Holiday policy

Health insurance (medical, dental, and

Remote work support

Care benefits

401k match and pension plans

Job summary

Whatnot is seeking a Red Team Engineer to identify weaknesses in cloud, identity, and CI/CD systems using AI-powered testing. You will plan and execute authorized engagements across AWS, Kubernetes, and internal apps, build robust testing harnesses, and produce actionable remediation guidance for engineers.

You will apply MITRE ATT&CK/ATLAS frameworks, conduct purple team exercises with detection engineering, and help elevate Whatnot’s security posture in a fast-paced, remote-friendly

Qualifications

• 3+ years in offensive security or red teaming or pentesting with real engagements
• Strong programming in Python; write own tooling
• Hands-on experience building LLM-powered workflows or agents (tool use, orchestration, evaluation, guardrails)
• Deep knowledge in at least two areas: cloud security, IAM abuse, Kubernetes/container escapes, web/API exploitation, CI/CD/supply chain attacks
• Knowledge of AI risk: prompt injection, data leakage, excessive agent permissions, model supply chain issues
• Judgment on scope and safety; ability to test prod-adjacent systems without outages
• Clear written reports that engineers can act on and executives can skim

Responsibilities

• Plan and run authorized red team operations across cloud (AWS), Kubernetes, networks, identity systems, SaaS, and internal apps
• Build and maintain AI-assisted testing harnesses with recon, attack-path discovery, fuzzing, and exploit validation
• Use LLMs and agent tools to speed up vulnerability research, payload generation, and report drafting
• Red team our own AI systems: prompt injection, tool abuse, data exfiltration, model boundaries, supply chain risk
• Emulate adversaries using MITRE ATT&CK and ATLAS to chain findings into end-to-end attack paths
• Run purple team exercises with detection engineering and incident response; tune detections
• Write findings with reproduction steps, impact, fixes; track remediation and retest
• Automate regression tests to ensure fixed weaknesses stay fixed and feed results into CI/CD
• Document and share techniques, tooling, and lessons learned with engineering teams
• Collaborate with Whatnot’s Blue Team on Purple Team engagements to strengthen security posture

Skills

Python

LLM workflows

Cloud security

Kubernetes

Tools

AWS

CI/CD

Job description

Join the Future of Commerce with Whatnot!

Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it’s trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We’re building live commerce at a scale that’s never been done in the West, and there’s no playbook to copy. The people here are shaping how an entirely new industry develops.

As a remote co-located team, we’re inspired by our values and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.

We’re one of the fastest growing marketplaces and were recently named the #1 Best Startup Employer in America by Forbes. Check out the latest Whatnot updates on our news and engineering blogs and join us as we enable anyone to turn their passion into a business and bring people together through commerce.

Role

• Plan and run authorized red team operations across cloud (AWS), Kubernetes, networks, identity systems, SaaS, and internal applications, under written rules of engagement.

• Build and maintain AI-assisted testing harnesses: agent loops that run recon, attack-path discovery, fuzzing, and exploit validation with logging, scoping controls, and human approval gates.

• Use LLMs and agentic tools to speed up vulnerability research, payload and test-case generation, code review, and report drafting, and measure where they help and where they mislead.

• Red team our own AI systems: prompt injection, tool and connector abuse, data exfiltration, model and agent permission boundaries, and supply chain risk in AI dependencies.

• Emulate realistic adversaries using MITRE ATT&CK and ATLAS, chaining findings into end-to-end attack paths rather than isolated bugs.

• Run purple team exercises with detection engineering and incident response, and tune detections based on what your tests evade.

• Write clear findings with reproduction steps, impact, and recommended fixes; track remediation to closure and retest.

• Automate regression tests so fixed weaknesses stay fixed, and feed results into CI/CD pipelines.

• Document and share techniques, tooling, and lessons learned with engineering teams.

• Work collaboratively with Whatnot’s Blue Team on Purple Team engagements to help strengthen Whatnot’s overall security posture.

You

Curious about who thrives at Whatnot? We’ve found that low ego, a growth mindset, and leaning into action and high impact goes a long way here.

As our next Red Team Engineer you’ll find weaknesses in our infrastructure before real attackers do. You will use AI tools and agents to scale offensive testing, build the harnesses that run it, and turn findings into fixes across cloud, network, application, identity and CI/CD layers.

• 3+ years in offensive security, red teaming, or penetration testing, with real engagements against production‑scale environments.

• Strong programming skills in Python; you write your own tooling instead of only running others.

• Hands‑on experience building LLM‑powered workflows or agents (tool use, orchestration, evaluation, guardrails), not just prompting a chat window.

• Deep knowledge of at least two areas: cloud security and IAM abuse, Active Directory or identity attacks, Kubernetes and container escapes, web and API exploitation, CI/CD and supply chain attacks.

• Working knowledge of AI‑specific risks: prompt injection, insecure tool use, data leakage, excessive agent permissions, and model supply chain issues.

• Sound judgment on scope, safety, and blast radius; you know how to test production‑adjacent systems without causing outages.

• Clear written communication: reports an engineer can act on and an executive can skim.

Benefits

• Generous Holiday and Time off Policy

• Health Insurance options including Medical, Dental, Vision

• Work From Home Support

• Care benefits

• Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally

• Monthly allowance to dogfood the app

• Parental Leave

Please note: Whatnot will only contact you through official @whatnot.com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.

EOE

Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law. We believe that our work is better and our company culture is improved when we encourage, support, and respect the different skills and experiences represented within our workforce.