Senior Offensive Security Engineer – Tests & Remediation

ww; United States; Remote; USD 120,000 - 210,000; Full time

Job summary

ww is seeking a senior security engineer to strengthen product security through offensive testing of web apps, APIs, identity systems, and cloud infra. The role emphasizes hands-on red/purple team work with remediation, secure engineering patterns, and guardrails, including AI-assisted workflows and audit logging.

You will implement fixes in TS/Node.js/React/Next.js and help raise secure coding standards across CI checks and tests.

Qualifications

• Senior-level security engineering experience spanning offensive testing and remediation.
• Strong knowledge of web application and API security risks (auth flaws, injection, SSRF, XSS).
• Ability to write and review TS/Node.js and React/Next.js changes.
• Experience with identity security, cloud security, and red team engagements.
• Familiar with SAST, DAST, software composition analysis, and bug bounty programs.
• Sound judgment for testing live systems safely with scoped, human-reviewed access.

Responsibilities

• Plan and conduct red team, purple team, and application penetration tests mapped to MITRE ATT&CK.
• Probe TypeScript applications and APIs for common weaknesses, and assess OAuth/OIDC, SSO, and sessions.
• Test production features under agreed rules with dedicated accounts, rate limits, and stop conditions.
• Build AI-assisted offensive testing workflows with audit logs, kill switches, and approvals for high-impact actions.
• Implement fixes in TS, Node.js, React, or Next.js, and create reusable secure patterns and CI checks.
• Improve security testing tools and processes including SAST, DAST, SCA, and bug bounty engagements.

Skills

Senior security engineering

Offensive testing

API security

TypeScript/Node.js

React/Next.js

Cloud security

SAST/DAST

Bug bounty programs

Secure remediation

Job description

ww is seeking a senior security engineer to strengthen product security through offensive testing of web apps, APIs, identity systems, and cloud infra. The role emphasizes hands-on red/purple team work with remediation, secure engineering patterns, and guardrails, including AI-assisted workflows and audit logging.

You will implement fixes in TS/Node.js/React/Next.js and help raise secure coding standards across CI checks and tests.