Senior/Staff Attack Engineer, Rapid Response

horizon3ai; United States; Remote; USD 230,000 - 275,000; Full time

Benefits offered by this job

Equity stock options

Dental insurance

Flexible vacation policy

Generous parental leave

Job summary

horizon3ai is seeking a Senior/Staff Attack Engineer for a fully remote Rapid Response product line. You will research real-world exploitation techniques and convert them into production-ready, automated capabilities that help customers understand exposure to disclosed or active vulnerabilities across enterprise, cloud, and hybrid environments.

This engineering-heavy role focuses on building safe, repeatable tooling for high-consequence issues, with emphasis on real-world attacker behavior,

Qualifications

• Strong Python and software engineering skills.
• Solid penetration testing, vulnerability research, and exploit development fundamentals.
• Hands-on experience with enterprise networks, applications, identity systems, cloud environments.
• Ability to reproduce vulnerabilities and convert manual techniques into automated tooling.
• Understanding of attack chains, trust boundaries, authentication and authorization, privilege escalation, and lateral movement.
• Ability to balance speed, safety, reliability, coverage, and evidence quality, with ownership and communication in ambiguous or time-sensitive situations.

Responsibilities

• Reproduce high-impact vulnerabilities across enterprise networks, applications, identity systems, cloud platforms, and infrastructure.
• Study attacker tactics, techniques, procedures, and campaigns observed in the wild.
• Translate vulnerability research and attacker behavior into safe, repeatable proof-of-exploit modules inside an automated assessment platform.
• Demonstrate realistic impact — privilege escalation, credential access, lateral movement, persistence, and data access — with minimal disruption to customer environments.
• Validate remediation and containment by safely retesting vulnerabilities and security controls.
• Improve execution speed, reliability, observability, and evidence quality in collaboration with research, product, and engineering teams.

Job description

Role overview

Join a remote cybersecurity organization as a Senior/Staff Attack Engineer focused on a Rapid Response product line. You will research real-world exploitation techniques and convert them into productionized, automated capabilities that help customers quickly understand exposure to newly disclosed or actively exploited vulnerabilities. This is an engineering-heavy offensive security role — not a traditional manual pentesting or consulting position — centered on building safe, repeatable tooling for high-consequence issues across enterprise, cloud, and hybrid environments.

Responsibilities

• Reproduce high-impact vulnerabilities across enterprise networks, applications, identity systems, cloud platforms, and infrastructure, including CISA KEVs, CVEs, N-Days, and Zero-Days.
• Study attacker tactics, techniques, procedures, and campaigns observed in the wild, including tradecraft not tied to a specific CVE.
• Translate vulnerability research and real-world attacker behavior into safe, repeatable proof-of-exploit modules and attack paths inside an automated assessment platform.
• Demonstrate realistic impact — privilege escalation, credential access, lateral movement, persistence, and data access — while avoiding unnecessary disruption to customer environments.
• Validate remediation and containment by safely retesting vulnerabilities and security controls.
• Improve execution speed, reliability, observability, and evidence quality in collaboration with research, product, and engineering teams.

Requirements

• Strong Python and software engineering skills, with experience building, testing, and operating production-quality tooling.
• Solid penetration testing, vulnerability research, and exploit-development fundamentals.
• Hands-on experience with enterprise networks, applications, identity systems, cloud environments, or endpoint security.
• Demonstrated ability to reproduce vulnerabilities and convert manual techniques into reliable automation.
• Understanding of attack chains, trust boundaries, authentication and authorization, privilege escalation, and lateral movement.
• Ability to balance speed, safety, reliability, coverage, and evidence quality, with strong ownership and communication in ambiguous or time-sensitive situations.

Nice to have

• Experience with CISA KEVs, CVE analysis, N-Day or Zero-Day research, or responsible disclosure.
• Background in incident response, threat hunting, purple teaming, or security operations.
• Experience with AWS, Azure, GCP, Kubernetes, Active Directory, Entra ID, Okta, or hybrid environments.
• Experience with exploit development, reverse engineering, malware analysis, or deeper vulnerability research.

Benefits and work setup

• Fully remote position.
• Base salary range of $230,000–$275,000 annually, depending on location, qualifications, and experience.
• Equity package in the form of stock options for full-time roles.
• Dental insurance coverage for you and your family.
• Flexible vacation policy and generous parental leave.