Senior Security Engineer, Offensive Security & Remediation

ww; United States; Remote; USD 120,000 - 210,000; Full time

Job summary

ww is seeking a senior security engineer to strengthen product security through offensive testing of web apps, APIs, identity systems, and cloud infra. The role emphasizes hands-on red/purple team work with remediation, secure engineering patterns, and guardrails, including AI-assisted workflows and audit logging.

You will implement fixes in TS/Node.js/React/Next.js and help raise secure coding standards across CI checks and tests.

Qualifications

• Senior-level security engineering experience spanning offensive testing and remediation.
• Strong knowledge of web application and API security risks (auth flaws, injection, SSRF, XSS).
• Ability to write and review TS/Node.js and React/Next.js changes.
• Experience with identity security, cloud security, and red team engagements.
• Familiar with SAST, DAST, software composition analysis, and bug bounty programs.
• Sound judgment for testing live systems safely with scoped, human-reviewed access.

Responsibilities

• Plan and conduct red team, purple team, and application penetration tests mapped to MITRE ATT&CK.
• Probe TypeScript applications and APIs for common weaknesses, and assess OAuth/OIDC, SSO, and sessions.
• Test production features under agreed rules with dedicated accounts, rate limits, and stop conditions.
• Build AI-assisted offensive testing workflows with audit logs, kill switches, and approvals for high-impact actions.
• Implement fixes in TS, Node.js, React, or Next.js, and create reusable secure patterns and CI checks.
• Improve security testing tools and processes including SAST, DAST, SCA, and bug bounty engagements.

Skills

Senior security engineering

Offensive testing

API security

TypeScript/Node.js

React/Next.js

Cloud security

SAST/DAST

Bug bounty programs

Secure remediation

Job description

Role overview

Strengthen product security through continuous offensive testing of web applications, APIs, identity systems, and cloud infrastructure, then turn findings into lasting fixes. The work is weighted toward hands-on red and purple team activity, with roughly a third focused on remediation, secure engineering patterns, and guardrails. Testing includes newly released features and AI-enabled workflows, under defined controls and human oversight.

Responsibilities

• Plan and conduct red team, purple team, and application penetration tests, mapping activity to MITRE ATT&CK and prioritizing account compromise, API abuse, cloud credential misuse, and data exposure risks.
• Probe TypeScript applications and APIs for common web and API weaknesses, and assess identity flows such as OAuth/OIDC, SSO, and session management.
• Test production features under agreed rules, using dedicated accounts, rate limits, and stop conditions that protect real user data.
• Build and operate AI-assisted offensive testing workflows for reconnaissance and attack path discovery, with scoped targets, audit logs, kill switches, and approval for high-impact actions; assess AI features for prompt injection, unsafe tool use, and data leakage.
• Implement fixes in TypeScript, Node.js, React, or Next.js code, and create reusable secure patterns and regression controls such as tests, lint rules, or CI checks.
• Improve security testing tools and processes, including SAST, DAST, dependency analysis, bug bounty, and third-party testing engagements from scoping through retesting.

Requirements

• Senior-level security engineering experience spanning offensive testing and practical remediation in software codebases.
• Strong knowledge of web application and API security risks, including authorization flaws, injection, SSRF, XSS, and insecure deserialization.
• Ability to write and review TypeScript/Node.js and React/Next.js changes, including safe dependency upgrades and tests.
• Experience with identity security, cloud security, and structured penetration testing or red team engagements.
• Familiarity with security testing tools and methods such as SAST, DAST, software composition analysis, and bug bounty programs.
• Sound judgment for testing live systems safely, with documented scope, human review, and protections against access to real member data.

Nice to have

• Experience testing AWS environments, including IAM privilege escalation and role chaining.
• Experience building AI-assisted security workflows or evaluating AI agents.