Senior IT Security Engineer - Offensive Security Lead

r1rcm; United States; On-site; USD 51,000 - 137,000; Full time

Job summary

R1 is hiring a Senior IT Security Engineer to strengthen how we identify and fix vulnerabilities before attackers exploit them. You will run hands-on penetration tests across internal and external infrastructure, networks, and web and mobile applications, across multiple cloud environments.

You'll build and extend a tooling suite, document findings with risk ratings and remediation guidance, and partner with engineering, infrastructure and product teams to validate fixes.

Qualifications

• 5+ years of hands-on experience in penetration testing and offensive security.
• At least one recognized offensive security certification (OSCP, GPEN, GWAPT, GXPN, CEH) with ongoing certification pursuit.
• Experience testing in AWS, Azure, and/or GCP environments.
• Knowledge of MITRE ATT&CK, OWASP Testing Guide, PTES frameworks.
• Proficient with security tooling and scripting to build custom tooling.

Responsibilities

• Plan and execute penetration tests across internal and external infrastructure, networks, and web/mobile apps.
• Perform application security testing—manual and tool-assisted—integrated into the SDLC.
• Test across multiple cloud environments (AWS, Azure, GCP) including IAM and workload exposure.
• Document findings with risk ratings, reproduction steps, and remediation guidance.
• Collaborate with engineering and product teams to validate fixes and reduce time-to-remediation.
• Support testing tied to HIPAA, SOC 2, and PCI DSS assessments and audits.
• Track emerging attack techniques and threat intelligence relevant to healthcare tech.
• Contribute to tabletop exercises and internal security training.

Skills

Penetration testing

Offensive security

Cloud environments

Security tooling

Scripting

HIPAA/SOC 2/PCI DSS

Education

OSCP

GPEN

GWAPT

GXPN

CEH

Tools

Burp Suite

Zap

Nmap

Metasploit

BloodHound

Nuclei

OWASP ZAP

Job description

R1 is hiring a Senior IT Security Engineer to strengthen how we identify and fix vulnerabilities before attackers exploit them. You will run hands-on penetration tests across internal and external infrastructure, networks, and web and mobile applications, across multiple cloud environments.

You'll build and extend a tooling suite, document findings with risk ratings and remediation guidance, and partner with engineering, infrastructure and product teams to validate fixes.