Senior Security Engineer, Offensive Security & Remediation

Weight Watchers; New York (NY); Hybrid; USD 180,000 - 195,000; Full time

Job summary

WeightWatchers in New York, NY is seeking a Senior Security Engineer focused on offensive testing, remediation, and security guardrails across web, API, and AWS infrastructure. Apply robust red team methodologies and validate protections in identity systems.

Responsibilities include testing TypeScript web apps and APIs against OWASP and API Top 10, conducting production-level security testing under strict engagement rules, and building agentic workflows with AI guidance under human oversight.

Qualifications

• 6+ years in security or software engineering.
• 3+ years hands-on offensive security experience (pentesting, red/purple team, or app security).
• Production engineering experience in TypeScript and Node.js, incl. fixes through code review, tests, and CI/CD.

Responsibilities

• Plan and execute red team, purple team, and application penetration tests mapped to MITRE ATT&CK.
• Test TypeScript web apps and APIs against OWASP Top 10 and API Top 10, focusing on broken authorization and IDOR, injection, SSRF, prototype pollution, XSS, and insecure deserialization.
• Continuously test features in production using agreed Rules of Engagement, test accounts, no access to real member data, rate limits, and stop conditions.
• Attack and validate protections in the identity stack (OIDC/OAuth, SSO, and session handling).
• Build and run agentic red team workflows using LLM-driven agents for recon and attack-path discovery under human oversight.

Skills

Offensive security

AWS security

TypeScript/Node.js

Web vulnerabilities

OAuth/OIDC

Tools

Burp Suite

Semgrep

CI/CD tooling

Job description

Senior Security Engineer focused on offensive testing, remediation, and security guardrails across web, API, and AWS infrastructure.

Responsibilities

• Plan and execute red team, purple team, and application penetration tests mapped to MITRE ATT&CK, targeting threats relevant to a consumer health company, including account takeover, API abuse, cloud credential misuse, and data exfiltration.
• Test TypeScript web apps and APIs against OWASP Top 10 and API Top 10, with focus on broken authorization and IDOR, injection, SSRF, prototype pollution, XSS, and insecure deserialization.
• Continuously test features as they ship in production using agreed rules of engagement, including dedicated test accounts, no access to real member data, rate limits, and defined stop conditions.
• Attack and validate protections in the identity stack including OIDC/OAuth, SSO, and session handling.
• Build and run agentic red team workflows using LLM-driven agents for recon, attack-path discovery, and continuous testing under human oversight, with scoped targets, kill switches, audit logging, and human approval before high-impact actions.
• Evaluate AI capabilities by testing for prompt injection, tool misuse, and data leakage.
• Scope, manage, and quality-check third-party pentest and red team engagements, covering rules of engagement through retest.
• Scope and ship remediation PRs in TypeScript/Node.js and React/Next.js, including tests and following team review and release processes.
• Fix vulnerable npm dependencies safely by handling upgrades, lockfile hygiene, and breaking changes.
• Develop secure-by-default libraries and patterns (authorization middleware, input validation schemas, safe output encoding, secrets handling) for adoption by product teams.
• Convert recurring finding classes into durable guardrails via regression tests, custom SAST or lint rules, or CI checks.
• Use AI coding assistants and agents to speed up remediation, with human review on every change.
• Emulate cloud attacks across AWS accounts, including IAM privilege escalation, role-chaining, cross-account trust abuse, and exposed credentials / IMDS abuse via SSRF.
• Test external exposure including public S3 buckets, API Gateway and Lambda misconfigurations, CloudFront, load balancer edge cases, and forgotten internet-facing assets.
• Assess EKS and Kubernetes for container escape, pod-to-cloud privilege paths, and secrets exposure.
• Map application attack paths to cloud impact and coordinate infrastructure fixes with platform owners using clear reproduction steps.
• Partner with the broader product security team to share priorities, findings, and participate in triage.
• Help run and tune security tooling including SAST, DAST, and SCA by reducing false positives and routing valid issues to owners.
• Triage and validate Bugcrowd submissions: reproduce reports, set severity, and collaborate on engineering fixes and payouts.
• Use and improve Claude Security to discover and patch vulnerabilities, validating findings and fixes with manual testing.
• Report outcomes including exploitable findings closed, time to remediate vs SLA, eliminated bug classes, and tooling signal-to-noise.

Requirements

• 6+ years in security or software engineering, with 3+ years hands-on offensive experience (pentesting, red or purple team, or application security testing).
• Hands-on offensive experience in AWS: IAM privilege escalation, cross-account and role-trust abuse, SSRF to metadata credentials, and misconfigured public services.
• Production engineering experience in TypeScript and Node.js, including shipped fixes that went through code review, tests, and CI/CD.
• Deep understanding of web and API vulnerabilities across OWASP Top 10 and API Security Top 10, including correct remediation in code.
• Experience safely testing live production systems under rules of engagement.
• Working experience with SAST, DAST, and SCA tools, including tuning and triage of outputs.
• Hands-on experience with or building agentic offensive workflows, with awareness of where they fail.
• Experience with Burp Suite or similar proxies, plus scripting custom tooling in TypeScript or Python.
• Solid knowledge of OAuth 2.0 and OIDC, including session management and authorization models.
• Clear writing that enables engineers to act on findings and produces PR descriptions reviewers can trust.

Technologies

• TypeScript, Node.js, React/Next.js
• MITRE ATT&CK, OWASP Top 10, API Top 10
• OIDC/OAuth, SSO
• SAST, DAST, SCA
• Bugcrowd
• Claude Security, LLM-driven agents
• Burp Suite
• Amazon Web Services (AWS), IAM, SSRF, SS3, IMDS
• API Gateway, Lambda, CloudFront, Load balancer
• EKS, Kubernetes
• npm, Semgrep, ESLint
• CloudFox, Prowler, Pacu
• Atomic Red Team, Caldera
• MCP servers
• Tool-calling LLM APIs
• OWASP Top 10 for LLM Applications, MITRE ATLAS
• SBOMs
• SOC 2, HITRUST, CCPA

Nice to Have

• React/Next.js and a Node.js framework such as NestJS or Express.
• npm supply chain security exposure, including SBOMs, provenance, lockfile and install-script risks.
• Experience writing custom SAST rules (Semgrep-style) or ESLint security rules.
• Experience managing third-party pentest or red team vendors end to end.
• Agent frameworks, MCP servers, or tool-calling LLM APIs; knowledge of OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Adversary-emulation tooling (e.g., Atomic Red Team, Caldera) and C2 frameworks.
• Experience running or triaging a bug bounty program (Bugcrowd or similar), or a personal bug bounty track record or published CVEs; cloud offensive tooling such as Pacu, CloudFox, or Prowler; AWS certifications (e.g., AWS Security Specialty).
• Experience in regulated environments (HITRUST, SOC 2, CCPA).

Recruitment Security & Fraud Prevention

• All official correspondence from the recruiting team originates from an @ww.com email address.
• Hiring requires live interaction; interviews and employment offers are not conducted solely through text message, chat apps, or automated email-only exchanges.
• WeightWatchers does not ask candidates for any form of payment.
• No checks will be sent with instructions to purchase equipment or “start-up kits.”
• Sensitive personal information is requested only through an official, secure onboarding portal after a formal offer, not during the interview phase.
• If contacted by someone claiming to represent WeightWatchers and the process differs from these standards, do not share personal information.
• Verify open positions via the official careers page: https://job-boards.greenhouse.io/ww.

Location: New York, NY (hybrid)
Salary: USD 180,000 - 195,000 per year
Minimum experience: 3 years