Senior Offensive Security Engineer - Cloud Web Remediation

Weight Watchers; New York (NY); Hybrid; USD 180,000 - 195,000; Full time

Job summary

WeightWatchers in New York, NY is seeking a Senior Security Engineer focused on offensive testing, remediation, and security guardrails across web, API, and AWS infrastructure. Apply robust red team methodologies and validate protections in identity systems.

Responsibilities include testing TypeScript web apps and APIs against OWASP and API Top 10, conducting production-level security testing under strict engagement rules, and building agentic workflows with AI guidance under human oversight.

Qualifications

• 6+ years in security or software engineering.
• 3+ years hands-on offensive security experience (pentesting, red/purple team, or app security).
• Production engineering experience in TypeScript and Node.js, incl. fixes through code review, tests, and CI/CD.

Responsibilities

• Plan and execute red team, purple team, and application penetration tests mapped to MITRE ATT&CK.
• Test TypeScript web apps and APIs against OWASP Top 10 and API Top 10, focusing on broken authorization and IDOR, injection, SSRF, prototype pollution, XSS, and insecure deserialization.
• Continuously test features in production using agreed Rules of Engagement, test accounts, no access to real member data, rate limits, and stop conditions.
• Attack and validate protections in the identity stack (OIDC/OAuth, SSO, and session handling).
• Build and run agentic red team workflows using LLM-driven agents for recon and attack-path discovery under human oversight.

Skills

Offensive security

AWS security

TypeScript/Node.js

Web vulnerabilities

OAuth/OIDC

Tools

Burp Suite

Semgrep

CI/CD tooling

Job description

WeightWatchers in New York, NY is seeking a Senior Security Engineer focused on offensive testing, remediation, and security guardrails across web, API, and AWS infrastructure. Apply robust red team methodologies and validate protections in identity systems.

Responsibilities include testing TypeScript web apps and APIs against OWASP and API Top 10, conducting production-level security testing under strict engagement rules, and building agentic workflows with AI guidance under human oversight.