Senior Offensive Security Engineer - Remote Cloud PenTests

Gainbridge; United States; Remote; USD 200,000 - 270,000; Full time

Benefits offered by this job

Health, dental & vision insurance

Life insurance

Short/long-term disability

401(k) with company match

Employee Assistance Program

Job summary

Group 1001 seeks a hands-on Senior Offensive Security Engineer to lead penetration testing and red team operations across cloud, endpoints, apps, and APIs. You will own the offensive testing program, perform tests, run red/purple exercises, manage the private bug bounty, and drive remediation with cross-functional teams.

You will embed with development groups, align testing with release cycles, and push security testing earlier in the lifecycle.

Qualifications

• 8+ years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles.
• Experience performing tests against cloud environments (Azure, AWS, GCP), endpoints, web and desktop apps, and APIs.
• Experience leading red/purple team operations and coordinating with cross-functional teams.

Responsibilities

• Plan, scope, execute, and report on penetration tests across cloud, endpoints, apps, and APIs.
• Lead quarterly red team and purple team exercises to test detection and response.
• Manage private bug bounty program: scope, triage, severity, remediation coordination.
• Oversee external penetration testing vendors and ensure alignment with priorities.
• Translate offensive findings into defensive improvements with security teams.
• Develop offensive tooling, techniques, and processes to improve program efficiency.

Skills

Penetration testing

Red teaming

Cloud security

Bug bounty

Threat hunting

Education

OSCP

OSWE

OSCE

GXPN

Tools

Burp Suite

Cobalt Strike

Custom C2 frameworks

Job description

Group 1001 seeks a hands-on Senior Offensive Security Engineer to lead penetration testing and red team operations across cloud, endpoints, apps, and APIs. You will own the offensive testing program, perform tests, run red/purple exercises, manage the private bug bounty, and drive remediation with cross-functional teams.

You will embed with development groups, align testing with release cycles, and push security testing earlier in the lifecycle.