Senior Offensive Security Engineer

Iceberg; Chicago (IL); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Iceberg in Chicago is seeking a Senior Offensive Security Engineer to join a highly technical global financial organisation building out its offensive security capability. This role requires thinking like an attacker, not merely running automated pentesting tools.

You’ll own engagements from reconnaissance through exploitation and lateral movement, collaborating with infrastructure, development and security teams to remediate and retest issues.

Qualifications

• 5+ years of hands-on offensive security experience.
• Ability to take engagements from recon to exploitation, privilege escalation and lateral movement.
• Strong communication and collaboration with engineering teams.

Responsibilities

• Red teaming and adversary simulation.
• Penetration testing across infrastructure, applications, APIs and cloud.
• Exploiting vulnerabilities across Windows, Linux and macOS environments.
• Building your own offensive tooling alongside using established tools.
• Working closely with defensive teams on purple team exercises.
• Owning vulnerability remediation through to resolution.
• Testing emerging attack vectors including AI and LLM environments.
• Helping shape the wider offensive security methodology and roadmap.

Skills

Offensive security

Red teaming

Penetration testing

Cloud security

Job description

Chicago preferred | NYC / London | Remote considered

Compensation open - scope to exceed your current package

I’m working on a talent-led search for a Senior Offensive Security Engineer to join a highly technical global financial organisation building out its offensive security capability.

This isn’t a role where you’ll simply be running automated pentesting tools.

They want someone who genuinely thinks like an attacker.

You’ll essentially operate as an internal hacker. Continuously looking for ways into systems, identifying weaknesses and then working directly with infrastructure, development and security teams to remediate and retest them.

You’ll have a lot of ownership from day one, including:

• Red teaming and adversary simulation
• Penetration testing across infrastructure, applications, APIs and cloud
• Exploiting vulnerabilities across Windows, Linux and macOS environments
• Building your own offensive tooling alongside using established tools
• Working closely with defensive teams on purple team exercises
• Owning vulnerability remediation through to resolution
• Testing emerging attack vectors including AI and LLM environments
• Helping shape the wider offensive security methodology and roadmap

I’m looking for someone with 5+ years of hands-on offensive security experience who can take an engagement from reconnaissance through exploitation, privilege escalation and lateral movement.

Strong communication is equally important. You need to be able to document what you find, explain the risk and work collaboratively with engineering teams to actually fix it.

Consultancies, financial institutions and mature internal red teams are all relevant backgrounds.

There is currently no dedicated person doing this internally, so there is significant scope to make the function your own. As the capability grows, this could also develop into a Lead position.

Compensation is deliberately open. The priority is finding the right person and I have flexibility to discuss packages that exceed current compensation for exceptional profiles.