Senior Offensive Security Engineer

About the role

A U.S.-based digital financial institution, represented by a confidential client, is building an AI-native security organization and needs a Senior Offensive Security Engineer. The engineer performs deep manual testing of customer-facing and internal web applications and APIs that handle financial data and customer information, supported by approved offensive AI technologies. This is not a scan-and-report role: every AI-generated hypothesis must be independently validated and proven exploitable.

Key responsibilities

• Perform full-scope penetration testing of web applications, APIs and supporting services, including threat modeling and analysis of architecture, trust boundaries, authentication, authorization and data flows.
• Identify and exploit complex vulnerabilities such as broken access control, IDOR/BOLA/BFLA, authentication and session weaknesses, business-logic abuse, injection, API authorization failures, privilege escalation and multi-step attack chains.
• Use approved offensive AI tools and LLM-based security tooling for reconnaissance, attack-surface analysis, test-case generation, hypothesis development and prioritization, then validate each finding with a reproducible proof-of-concept.
• Develop reusable prompts, Python scripts, agents, API integrations and workflows, and document AI-assisted testing so it can be repeated.
• Write reports with executive summaries, technical analysis, reproduction steps, evidence and remediation guidance, and work with engineering teams to explain weaknesses and support remediation.
• Recommend systemic fixes, improve testing methodology and tooling, and lead knowledge-sharing sessions and peer review.