Senior Offensive Security Engineer

Unity; Washington; On-site; USD 160,000 - 241,000; Full time

Benefits offered by this job

Health insurance

Commuting subsidy

Employee stock ownership

Retirement plans

Generous vacation

Parental leave

Mental health programs

Training & development

Job summary

Unity is seeking a senior security professional to lead offensive security, red teaming, and adversary emulation across Unity’s vast product surface. You will plan and execute objective-based campaigns, test cloud environments, and collaborate with engineering to fix real threats while developing scalable tooling.

Ideal candidates bring 6+ years in offensive security, strong web/API testing, and experience with multi-cloud and CI/CD.

Qualifications

• 6+ years in offensive security (red teaming, penetration testing, purple teaming, or vulnerability research).
• Hands-on experience attacking cloud environments (GCP, AWS, or Azure) with identity, Kubernetes, containers, and CI/CD.
• Strong web application and API security testing skills; identify logic flaws, not just scanners.
• Solid scripting or programming ability (Python/Go/C/C++) to build tools and exploits.
• Experience running adversary emulation or red team ops and collaborating with defenders.
• Clear written and verbal communication; able to explain risk to engineers and leaders.
• Enjoys teamwork and collaborative problem-solving.

Responsibilities

• Adversary emulation and red teaming across cloud, corporate, and production environments; purple team exercises to test detection and response.
• Deep security testing of Unity products and services, including web apps, APIs, engine, editor, and client runtime.
• Identify and demonstrate attack paths across multi-cloud environments (GCP, AWS, Azure), Kubernetes, containers, CI/CD, identity, and secrets.
• Test AI-native products and agent workflows for prompt injection, data leakage, and permission issues.
• Write prioritized findings with remediation guidance and retest fixes.
• Build and maintain offensive tooling to scale testing and automate checks.

Skills

Offensive security

Cloud security

Web security testing

Scripting languages

Red team operations

Communication

Team player

LLM security

Reverse engineering

Industry experience

Bug bounty / CVE

Certifications

Job description

About The Role

You will find our weaknesses before someone else does. Unity's attack surface spans the engine and editor that developers build on, the client runtime shipped in games played by billions of people, a broad portfolio of cloud products and services, a large ads and monetization business, our corporate environment, and a fast-growing set of AI-assisted and agentic tools. Your job is to attack all of it the way a real adversary would, and to turn what you find into fixes that stick.

About The Role

You will find our weaknesses before someone else does. Unity's attack surface spans the engine and editor that developers build on, the client runtime shipped in games played by billions of people, a broad portfolio of cloud products and services, a large ads and monetization business, our corporate environment, and a fast-growing set of AI-assisted and agentic tools. Your job is to attack all of it the way a real adversary would, and to turn what you find into fixes that stick.

This is not a checklist pen-testing role. You will plan and run realistic attack campaigns, chain small weaknesses into real impact, and explain clearly to engineers and leaders what an attacker could actually do and what matters most to fix. You will work closely with Product Security, Infrastructure Security, Security Operations, and engineering teams, and you will help build the tooling and automation that let a small offensive team cover a very large surface.

What You Will Own

• Adversary emulation and red teaming: plan and run objective-based red team operations against our cloud, corporate, and production environments, modeled on threats relevant to Unity. Run purple team exercises with Security Operations to test and improve detection and response.
• Application testing: deep security testing of Unity products and services, including web applications and APIs, the engine, editor and client runtime, ads and monetization systems, and developer-facing platforms.
• Cloud and infrastructure attack paths: find and demonstrate attack paths across multi-cloud environments (GCP, AWS, Azure), Kubernetes and containers, CI/CD pipelines, identity, and secrets.
• AI and agentic systems: test LLM integrations, AI-native products, and agent workflows for issues such as prompt injection, data leakage, tool misuse, and excessive permissions.
• Findings to fixes: write clear, prioritized findings with realistic impact, work with owning teams on remediation, and retest to confirm fixes.
• Offensive tooling and automation: build and maintain tools, scripts, and automation that scale adversarial engineering, testing and turn repeated findings into continuous checks.

What Success Looks Like In The First 12 Months

• A risk-based testing plan across Unity's highest-value targets, agreed with security leadership and the owning engineering teams.
• Several end-to-end red team or adversary emulation operations completed, each with clear findings, executive-ready readouts, and tracked remediation.
• Measurable improvements in detection from purple team exercises with Security Operations.
• Reusable tooling or automation that turns recurring classes of findings into continuous checks.

Required

What you bring

• 6+ years in offensive security (red teaming, penetration testing, purple teaming, or vulnerability research), including leading engagements end to end.
• Hands-on experience attacking cloud environments (GCP, AWS, or Azure), including identity, Kubernetes and containers, and CI/CD.
• Strong web application and API security testing skills, with the ability to find logic flaws, not just scanner results.
• Solid scripting or programming ability (for example Python, Go, or C/C++) to build tools and exploits.
• Experience running adversary emulation or red team operations against realistic objectives, and working with defenders in purple team exercises.
• Clear written and verbal communication. You can explain technical risk to engineers and to non-technical leaders.
• You genuinely enjoy working as part of a team, sharing ideas, offering support, and celebrating wins together.

Preferred

• Experience testing LLM-based products, AI agents, or AI-assisted developer tools.
• Reverse engineering, binary exploitation, or game client and anti-cheat security experience.
• Experience in gaming, ad tech, or large developer-facing platforms.
• Bug bounty, CVEs, conference talks, published research, or open-source security tooling.
• Relevant certifications (OSCP, OSEP, OSWE, CRTO) are useful but will not substitute for a track record.

How You Work

You think like an attacker and act like a partner. You go after real impact, not volume of findings, and you know the difference between an issue that matters and one that only looks bad in a report. You operate safely in production, with clear rules of engagement. You automate what you do twice. You build trust with engineering teams so they want you involved early, and you hold a high bar on getting fixes done.

Base Salary Range

We determine the base salary range for this role based on your primary work location:

• Zone A: $160,300 - $240,500 USD gross
• Zone B: $181,200 - $271,800 USD gross
• Zone C: $203,600 - $305,400 USD gross

This range reflects the anticipated base salary for this position. Beyond base salary, this role may be eligible for equity awards and participation in our company incentive plans (such as annual discretionary bonuses or sales commissions). The final offer amount will depend on several factors, including geographic location and the candidate’s relevant experience, professional background, and skill set.

Benefits

At Unity, we want our team members to thrive. We offer a wide range of benefits designed to support well-being and work-life balance.

Please note: Benefits eligibility, specific offerings, and coverage vary based on the country and employment status.

• Comprehensive health, life, and disability insurance
• Commute subsidy
• Employee stock ownership
• Competitive retirement/pension plans
• Generous vacation and personal days
• Support for new parents through leave and family-care programs
• Office food snacks
• Mental Health and Wellbeing programs and support
• Employee Resource Groups
• Global Employee Assistance Program
• Training and development programs
• Volunteering and donation matching program

Life at Unity

Unity [NYSE: U] is the world's leading game engine, powering play for more than 3 billion consumers each month. The top mobile games in the world, the most played PC indie titles, the most innovative console games, and virtually all of the top XR and Web Games are developed, deployed, and grown in Unity. Unity also enables teams across industries like automotive, manufacturing, and healthcare to design, simulate, and collaborate in 3D - closing the gap between ideas and reality. For more information, please visit www.unity.com.

Unity is a proud equal opportunity employer. We are committed to fostering an inclusive, innovative environment and celebrate our employees across age, race, color, ancestry, national origin, religion, disability, sex, gender identity or expression, sexual orientation, or any other protected status in accordance with applicable law. Our differences are strengths that enable us to support the growing and evolving needs of our customers, partners, and collaborators. If you have a disability that means there are preparations or accommodations we can make to help ensure you have a comfortable and positive interview experience, please fill out this form to let us know.

Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

This position requires the incumbent to have a sufficient knowledge of English to have professional verbal and written exchanges in this language since the performance of the duties related to this position requires frequent and regular communication with colleagues and partners located worldwide and whose common language is English.

Headhunters and recruitment agencies may not submit resumes/CVs through this Web site or directly to managers. Unity does not accept unsolicited headhunter and agency resumes. Unity will not pay fees to any third-party agency or company that does not have a signed agreement with Unity.

Your privacy is important to us. Please take a moment to review our Prospect and Applicant Privacy Policies. Should you have any concerns about your privacy, please contact us at [e-mail].