Senior Offensive Security Engineer

RXinsider LTD.; Naperville, Northern (IL, KY); Hybrid; USD 101,000 - 152,000; Full time

Job summary

Ecolab is seeking an experienced security professional to perform hands-on offensive security testing across web, mobile, APIs, cloud services, IoT, and embedded devices. You will plan assessments, mentor engineers, and translate findings into prioritized remediation actions that align with business risk.

The role requires strong expertise in offensive security, security tooling, and secure SDLC practices, with the ability to collaborate with product, engineering, and cloud teams to improve

Qualifications

• Bachelor's degree in cybersecurity or related technology field.
• 5+ years of hands-on cybersecurity, application security, or related field.
• Experience performing authorized testing of web, mobile, APIs, cloud, and/or IoT products.
• Experience supporting offensive security engagements, vulnerability assessments, and security reporting.
• Experience mentoring engineers and coordinating testing activities while remaining hands-on.
• Experience with Azure; familiarity with AWS/GCP cloud security concepts.
• Experience with security testing tools and practices including SAST, SCA, DAST, API testing, and secure code review concepts.
• Familiarity with secure SDLC, DevSecOps, CI/CD pipelines, IAM, encryption, and secrets management.
• Understanding of IoT, embedded, industrial, or field-deployed technology security considerations.
• Familiarity with OWASP, CIS, NIST, ISO 27001, SOC 2, and secure SDLC practices.
• Strong interpersonal, analytical, problem-solving, and communication skills.
• Ability to communicate findings clearly to technical and non-technical stakeholders.
• Ability to accommodate a flexible work schedule for global activities.

Responsibilities

• Perform hands-on offensive security testing across Ecolab products (web, mobile, APIs, cloud, IoT, embedded devices).
• Plan, scope, and execute security assessments to identify vulnerabilities and misconfigurations.
• Mentor engineers and document findings; contribute to repeatable testing methods and reporting standards.
• Translate testing results into remediation actions and risk-based priorities.
• Collaborate with product/security teams to drive practical remediation and governance.
• Conduct safe testing of IoT/industrial equipment, including field devices and PLC/IPC interfaces.
• Utilize security tools (Snyk, Wiz, Burp Suite, ZAP, GitHub AS) to identify and document issues.
• Validate vulnerabilities from various sources and prepare clear, actionable reports.
• Present findings to engineering and leadership with business context and risk.

Skills

Offensive security

Penetration testing

Cloud security

IoT security

DevSecOps

Threat modelling

Communication

Education

Bachelor's degree in Cybersecurity/CS/IT/Engineering

Tools

Snyk

Wiz

Burp Suite

OWASP ZAP

GitHub Advanced Security

Nmap

Horizon3 NodeZero

DAST tooling

Job description

What You Will Do

• Perform hands-on offensive security testing across Ecolab commercial products, including web applications, mobile applications, APIs, cloud services, IoT platforms, PLC/IPC-connected equipment, embedded devices, and product integrations.
• Plan, scope, and execute technical security assessments focused on identifying exploitable vulnerabilities, attack paths, insecure configurations, weak access controls, exposed secrets, insecure APIs, cloud misconfigurations, and product-specific security gaps.
• Support offensive security engagements and mentor engineers as needed while remaining highly hands-on in day-to-day testing, analysis, documentation, and remediation validation activities.
• Contribute to repeatable red team and offensive testing methods, engagement rules, reporting standards, evidence expectations, and risk-rating approaches appropriate for commercial digital products.
• Partner with product security, application engineering, cloud engineering, IoT engineering, architecture, and business teams to translate testing results into clear remediation actions and risk-based priorities.
• Conduct safe and authorized technical testing of IoT and industrially connected equipment, including physical access testing of product hardware, field devices, PLC/IPC interfaces, device communications, and related technology components where appropriate.
• Use commercial and enterprise-approved security tools such as Snyk, Wiz, Burp Suite, OWASP ZAP, GitHub Advanced Security, Nmap, Horizon3 NodeZero, DAST tooling, and related technologies to identify, validate, and document security issues.
• Validate vulnerabilities discovered through internal testing, automated scanning, third-party penetration testing, customer inquiries, bug reports, and product security reviews.
• Prepare clear, actionable reports that explain vulnerability impact, exploitability, business context, affected assets, remediation guidance, compensating controls, and validation results.
• Present technical findings to engineering teams and non-technical stakeholders at all levels of the organization, communicating risk, business impact, and practical remediation paths.
• Support product threat modeling, secure architecture reviews, application security reviews, cloud security assessments, and security design discussions based on offensive testing insights.
• Support improvements to Ecolab’s vulnerability management, secure SDLC, DevSecOps, and product security governance practices by identifying recurring weakness patterns and practical control improvements.
• Support coordination with third-party penetration testing providers when appropriate, including scope development, test readiness, evidence review, finding validation, and remediation tracking.
• Maintain awareness of emerging offensive security techniques, AI-enabled attack methods, application security risks, cloud security trends, IoT attack vectors, and relevant industry standards.
• Act as an advocate and champion for practical, risk-based product security across Ecolab’s commercial digital product teams.

Minimum Qualifications

• Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, Engineering, or related technology-driven field.
• 5+ years of hands-on experience in cybersecurity, application security, offensive security, penetration testing, product security, cloud security, IoT security, software engineering, or related technical field.
• Demonstrated hands-on experience performing authorized technical security testing of web applications, mobile applications, APIs, cloud services, and/or IoT-connected products.
• Experience supporting offensive security engagements, vulnerability assessments, penetration tests, remediation validation, and technical security reporting.
• Experience supporting technical workstreams, mentoring engineers, or coordinating testing activities while remaining directly involved in hands-on testing and analysis.
• Experience with Microsoft Azure; familiarity with AWS and/or GCP cloud security concepts, services, and common misconfiguration risks.
• Experience with application security testing tools and practices, including SAST, SCA, DAST, API testing, cloud security posture assessment, vulnerability validation, and secure code review concepts.
• Familiarity with tools such as Snyk, Wiz, Burp Suite, OWASP ZAP, GitHub Advanced Security, Nmap, Horizon3 NodeZero, DAST tooling, and related offensive or product security testing technologies.
• Knowledge of secure software development, DevSecOps, CI/CD pipelines, identity and access management, encryption, secrets management, secure API design, and secure cloud architecture principles.
• Understanding of IoT, embedded, industrial, or field-deployed technology security considerations, including device communications, network segmentation, authentication, update mechanisms, and physical access risks.
• Familiarity with industry frameworks and standards such as OWASP, CIS, NIST, ISO 27001, SOC 2, and secure SDLC practices.
• Strong interpersonal, analytical, problem-solving, organizational, and written/verbal communication skills.
• Ability to communicate technical findings clearly to software engineers, architects, cybersecurity leaders, product owners, and non-technical business stakeholders.
• Ability to accommodate a flexible work schedule for supporting global activities.

Preferred Qualifications

• One practical offensive security certification such as OSCP, GPEN, GWAPT, GWEB, PNPT, or similar hands-on application, web, cloud, or penetration testing certification.
• Experience testing commercial software products, SaaS platforms, customer-facing applications, cloud-hosted services, mobile applications, APIs, IoT platforms, or connected equipment.
• Experience with hardware, embedded systems, PLC/IPC-connected devices, industrial communications, device provisioning, secure firmware/update processes, or field-deployed technology.
• Experience with Azure security services, cloud-native application security, container security, Kubernetes security, and identity-based cloud controls.
• Experience integrating offensive security findings into vulnerability management, secure architecture, threat modeling, product risk governance, and engineering remediation workflows.
• Experience contributing to testing playbooks, reporting templates, engagement standards, risk-rating models, and remediation validation procedures.
• Experience with AI-enabled products, AI integrations, or the security implications of AI/ML capabilities in commercial software environments.
• Ability to influence without authority and drive security improvements across globally distributed engineering, product, and technology teams.

Annual Or Hourly Compensation Range

The pay range for this position is $101,400.00 - $152,100.00. Many factors are taken into consideration when determining compensation, such as experience, education, training, geography, etc. We comply with all minimum wage and overtime laws.

Benefits

Ecolab strives to provide comprehensive and market-competitive benefits to meet the needs of our associates and their families. Click here to see our benefits.

If you are viewing this posting on a site other than our Ecolab Career website, view our benefits at jobs.ecolab.com/working-here.

Potential Customer Requirements Notice

• Undergo additional background screens and/or drug/alcohol testing for customer credentialing.

Americans With Disabilities Act (ADA)

Ecolab will provide reasonable accommodation (such as a qualified sign language interpreter or other personal assistance) with our application process upon request as required to comply with applicable laws. If you have a disability and require accommodation assistance in this application process, please visit the Recruiting Support link in the footer of each page of our career website.

Our Commitment to a Culture of Inclusion & Belonging

At Ecolab, we believe the best teams are inclusive. We are on a journey to create a workplace where every associate can grow and achieve their best.

We are committed to fair and equal treatment of associates and applicants and recruit, hire, promote, transfer and provide opportunities for advancement based on individual qualifications and job performance.

In all matters affecting employment, compensation, benefits, working conditions, and opportunities for advancement, we will not discriminate against any associate or applicant for employment because of race, religion, color, creed, national origin, citizenship status, sex, sexual orientation, gender identity and expressions, genetic information, marital status, age, disability, or status as a covered veteran.

In addition, we are committed to furthering the principles of Equal Employment Opportunity (EEO) through affirmative action (AA).

We will consider for employment all qualified applicants, including those with criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the San Francisco Fair Chance Ordinance, and the New York City Fair Chance Act.