Senior Offensive Security Engineer

CoStar Group, Inc.; Arlington (VA); On-site; USD 110,000 - 150,000; Full time

Job summary

A leading global provider of real estate information, CoStar Group, is seeking a Senior Offensive Security Engineer to advance their security capabilities. This role involves leading penetration testing efforts, mentoring team members, and ensuring robust security practices across systems. The ideal candidate will have strong offensive security experience, relevant degree, and certifications.

Benefits

Competitive compensation

Professional growth opportunities

Comprehensive healthcare

401(k) matching

Paid time off

Tuition reimbursement

Onsite fitness facilities

Qualifications

• At least 3 years of offensive security experience.
• 6 years total experience in security or related roles.
• Security certifications such as OSEP, OSCP, or similar.

Responsibilities

• Lead purple team activities and validation of security controls.
• Plan and oversee external red team engagements.
• Conduct internal penetration testing of critical infrastructure.

Skills

Penetration testing

Vulnerability research

Scripting skills in Bash

Scripting skills in Python

Scripting skills in PowerShell

Education

Bachelor’s Degree in Computer Science

Bachelor’s Degree in Cyber Security

Tools

NMAP

Burp Suite

Kali Linux

Bloodhound

Job description

Senior Offensive Security Engineer

Job Description

CoStar Group (NASDAQ: CSGP) is a leading global provider of commercial and residential real estate information, analytics, and online marketplaces. Included in the S&P 500 Index and the NASDAQ 100, CoStar Group is on a mission to digitize the world’s real estate, empowering all people to discover properties, insights, and connections that improve their businesses and lives. With over 37 years of experience, we create unique and valuable offerings for our customers by continuously refining and transforming our approach.

We are seeking a Senior Offensive Security Engineer to evolve our offensive security capabilities. This role involves testing internal and external processes, infrastructure, and applications, developing test plans to validate vulnerabilities, and demonstrating exploits. Explaining exploits to senior management is key. The position may be located in Arlington, VA or Richmond, VA, with in-office work Monday through Thursday and remote work on Friday.

Responsibilities

1. Lead purple team activities, including adversary emulation and validation of security controls.
2. Plan and oversee external red team engagements with partners.
3. Mentor and share knowledge with security team members.
4. Conduct internal penetration testing of critical infrastructure, including CI/CD systems and Active Directory, as both a team leader and participant.

Basic Qualifications

• Bachelor’s Degree in Computer Science, Cyber Security, or related field from an accredited institution.
• At least 3 years of offensive security experience (red teaming, penetration testing, vulnerability research).
• 6 years of total experience in security, networking, systems, or software development roles.
• Security certifications such as OSEP, OSCP, CRTO, GXPN, or similar.
• Scripting skills in Bash, Python, PowerShell.

Preferred Skills

• Experience with security tools like NMAP, Burp Suite, Kali Linux, Bloodhound.
• Knowledge of C2 frameworks such as Cobalt Strike, Sliver, Mythic.
• Experience with Windows Active Directory exploitation.
• Understanding of payload and exploit development in C/C#/C++.
• Knowledge of EDR evasion techniques.

Benefits

Join CoStar Group and enjoy a collaborative culture, competitive compensation, professional growth opportunities, comprehensive healthcare, 401(k) matching, employee stock purchase plan, paid time off, tuition reimbursement, onsite fitness facilities, and more. We are committed to diversity and equal opportunity employment.

This job posting is active, and we welcome qualified candidates to apply. We are unable to provide visa sponsorship for this position.