Senior Offensive Security Engineer

Array; United States; On-site; USD 170,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Unlimited PTO

401k match up to 4%

Parental leave

Desk setup subsidy

Wifi stipend

Summer Fridays

Commuter benefits

Job summary

Array, a remote-first fintech security company, is seeking an Offensive Security Engineer to think like an attacker and validate our products through real-world exploitation. You’ll have full access to applications, source code, and infrastructure to identify vulnerabilities that pose real business risk.

You’ll leverage AI to analyze large codebases, develop proof‑of‑concept exploits, and collaborate with engineering to validate remediations while enhancing Array’s offensive security

Qualifications

• 5+ years of offensive security, application security, penetration testing, or red team experience with a track record of finding real application vulnerabilities.
• Deep expertise in modern web applications, APIs, authentication, authorization, distributed systems, and the OWASP Top 10.
• Experience developing proof-of-concept exploits that demonstrate real business impact, not just theoretical risk.
• Proficiency using AI to accelerate vulnerability discovery, exploit development, code analysis, and security research while validating AI-generated output.
• Strong communication skills with the ability to explain complex vulnerabilities, attack paths, and remediation guidance to engineering teams.

Responsibilities

• Identify, validate, and demonstrate realistic attack paths against Array's products, infrastructure, and internal systems with a focus on business impact.
• Analyze large, multi-language codebases using AI and manual techniques to uncover vulnerabilities, generate exploit hypotheses, and perform variant analysis.
• Build safe proof-of-concept exploits that demonstrate unauthorized access, privilege escalation, data exposure, business logic flaws, or other meaningful security risks.
• Partner with engineering to validate remediations, confirm exploit paths are fully eliminated, and identify similar patterns elsewhere in the environment.
• Document findings with clear evidence, technical root cause, business impact, and practical remediation guidance while continuously improving Array's offensive security capabilities.
• Maintain a habit of using AI tools to think, build, and ship faster—it’s your default, not an afterthought.

Skills

Offensive security

Web apps & APIs

Exploit development

AI in security

Communication

Job description

Array is a financial innovation platform that helps digital brands, financial institutions, and fintechs get compelling consumer products to market faster. We deliver a suite of credit and identity monitoring tools, privacy protection, and a financial ads marketplace via embeddable widgets or a clean, modern API. Our private label offerings help drive revenue and increase engagement for our customers while empowering millions of consumers to achieve their financial goals.

As a remote-first company, we’re focused on providing opportunities for high performing individuals to have deep impact in the fast growing fintech space. A clear mission, a commitment to continuous improvement and a willingness to experiment empower us individually and together deliver the best products for our clients and users.

We're looking for an Offensive Security Engineer to think like an attacker and validate the security of Array's products through real-world exploitation. You’re a paid hacker; you'll operate with full access to our applications, source code, and infrastructure to identify vulnerabilities that create meaningful business risk—not theoretical findings. AI should be one of your primary tools, enabling you to analyze large codebases, accelerate hypothesis generation, and increase testing coverage while relying on your own judgment to validate results.

You Have:

• 5+ years of offensive security, application security, penetration testing, or red team experience with a track record of finding real application vulnerabilities.
• Deep expertise in modern web applications, APIs, authentication, authorization, distributed systems, and the OWASP Top 10.
• Experience developing proof-of-concept exploits that demonstrate real business impact, not just theoretical risk.
• Proficiency using AI to accelerate vulnerability discovery, exploit development, code analysis, and security research while validating AI-generated output.
• Strong communication skills with the ability to explain complex vulnerabilities, attack paths, and remediation guidance to engineering teams.
• A belief that AI is reshaping work, you instinctively use it to accelerate everything you do.

You Will:

• Identify, validate, and demonstrate realistic attack paths against Array's products, infrastructure, and internal systems with a focus on business impact.
• Analyze large, multi-language codebases using AI and manual techniques to uncover vulnerabilities, generate exploit hypotheses, and perform variant analysis.
• Build safe proof-of-concept exploits that demonstrate unauthorized access, privilege escalation, data exposure, business logic flaws, or other meaningful security risks.
• Partner with engineering to validate remediations, confirm exploit paths are fully eliminated, and identify similar patterns elsewhere in the environment.
• Document findings with clear evidence, technical root cause, business impact, and practical remediation guidance while continuously improving Array's offensive security capabilities.
• Maintain a habit of using AI tools to think, build, and ship faster—it’s your default, not an afterthought.

Success Looks Like:

• Demonstrated exploit paths to sensitive data, unauthorized access, or privilege escalation.
• Security gaps identified that were not detected by existing tools or processes.
• High-confidence validation that engineering fixes eliminate vulnerabilities and related attack paths.
• Meaningful system coverage supported by documented testing methodology, whether vulnerabilities are found or not.

Pay Transparency:

$170,000 + for base salary, depending on experience. Full time employee compensation includes an Incentive Stock Option (ISO) grant, subject to Board approval.

Expected interview process:

Recruiter Conversation - Hiring Manager Interview - Loop round: How We Work, Engineering leadership.

Array Offers All Full Time Employees the following Benefits and Perks:

• Full medical, dental, and vision, premiums covered at 100% for full-time employees and 70% for dependents
• Unlimited PTO and sick leave + 14 company holidays to encourage a healthy work-life blend
• 100% 401k match up to 4% with immediate vesting
• Generous and competitive parental leave for all parents
• $1,000 desk setup subsidy to set-up your unique remote office
• $100/month to subsidize wifi/cell phone expenses
• Summer Fridays (half-day Fridays) typically from late May to the end of August
• Commuter benefits for those who choose to go into our New York City or San Francisco office spaces

We are proud to be an equal opportunity workplace; we are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity or Veteran status. Array will provide reasonable accommodations to qualified applicants—if you need an accommodation to participate in the application or interview process, please email [e-mail] to make your request.

Array uses CLEAR to conduct identity verification as part of the application process. We encourage you to review CLEAR’s Privacy Notice and Terms of Use to understand how your personal data will be processed.