Staff Offensive Security Engineer

Twilio; San Francisco (CA); On-site; USD 183,000 - 229,000; Full time

Benefits offered by this job

Health insurance

Paid time off

Job summary

Twilio is seeking a Staff Offensive Security Engineer to design complex attack chains and lead multi‑week Red Team operations. You will write custom code, develop bypass techniques, and guide engineering teams on patching critical vulnerabilities.

You will perform manual and automated testing of web apps, APIs, and mobile apps, while conducting network and cloud audits and building automated testing frameworks for AI systems. Remote work is supported with location restrictions.

Qualifications

• 7–10 years in offensive security, pentesting, or vulnerability exploitation.
• Expert understanding of MITRE ATT&CK and OWASP Top 10 for web and LLMs.
• Proficient with Burp Suite, Nmap, Metasploit, and Wireshark.
• Able to write Python or Bash scripts to automate tests.
• Experience with AI security tools and C2 frameworks is desirable.

Responsibilities

• Perform full‑stack penetration testing of web apps, APIs, and mobile apps.
• Conduct internal/external network and cloud assessments.
• Validate vulnerabilities from scanners and bug bounty reports.
• Perform AI/LLM probing and jailbreak testing using established checklists.
• Draft high‑quality, reproducible technical reports for developers.

Skills

Penetration testing

MITRE ATT&CK

OWASP Top 10

Adversarial ML

Python Bash scripting

Tools

Burp Suite

Nmap

Metasploit

Wireshark

LangChain

TensorFlow

Cobalt Strike Sliver Havoc

Job description

Twilio is seeking a Staff Offensive Security Engineer to design complex attack chains and lead multi‑week Red Team operations. You will write custom code, develop bypass techniques, and guide engineering teams on patching critical vulnerabilities.

You will perform manual and automated testing of web apps, APIs, and mobile apps, while conducting network and cloud audits and building automated testing frameworks for AI systems. Remote work is supported with location restrictions.