We are seeking a skilled and technically driven Offensive Security Engineer to join our security team. The ideal candidate combines advanced application penetration testing expertise, a deep understanding of complex business logic vulnerabilities, hands-on experience with modern DevSecOps practices and security automation, and familiarity with white-box security testing.

This role goes beyond traditional vulnerability scanning and OWASP Top 10 assessments. You will be responsible for identifying sophisticated security weaknesses in application architectures, distributed systems, APIs, asynchronous workflows, transaction processing, and business-critical operations.

We are particularly interested in engineers who can think like attackers, understand applications as interconnected state machines, identify subtle trust boundary violations, and develop creative exploitation scenarios that automated security tools cannot detect.

Key Responsibilities

1. Offensive Application Security
Conduct comprehensive black-box, gray-box, and white-box penetration testing of web applications, APIs, microservices, and distributed application architectures.
Perform manual security assessments focused on business logic, application state transitions, authentication, authorization, and transaction integrity.
Conduct secure code reviews and identify vulnerabilities that may not be detected by automated SAST, DAST, or SCA tools.

2. Business Logic and Workflow Exploitation
A major focus of this position is identifying sophisticated vulnerabilities arising from incorrect application logic, state management, transaction processing, and trust assumptions.
Candidates must have strong practical experience identifying and exploiting the following vulnerability classes:
Logical Flow Abuse Vulnerabilities
State Confusion
Workflow Bypasses
Race Conditions
Out-of-Order Workflow Execution
Cross-Context Confusion

3. DevSecOps and Security Automation
Design, implement, and maintain application security controls within CI/CD pipelines.
Optimize SAST, DAST, SCA, container security scanning, and secrets detection.
Build automated security gates and risk-based vulnerability management processes.
Fine-tune security rulesets and detection use cases based on historical vulnerabilities in microservices.
Develop scripts and integrations to automate vulnerability triage, security reporting, and remediation tracking.

4. Elasticsearch, ELK Stack, Splunk, and Security Analytics
Work with Elasticsearch, Logstash, Kibana (ELK Stack), and Splunk to investigate application security events and suspicious behavior.
Correlate application logs, API activity, transaction events, and distributed traces to identify security flaws.
Collaborate with security operations teams to translate offensive security findings into actionable detection use cases.

5. Vulnerability Management and Engineering Collaboration
Document security findings with clear technical descriptions, evidence, proof-of-concept demonstrations, impact assessments, and remediation recommendations.
Prioritize vulnerabilities based on exploitability, business impact, and application criticality.
Work directly with developers to design secure fixes for complex business logic and architectural vulnerabilities.
Perform remediation verification and regression testing.
Support security knowledge-sharing sessions, technical workshops, and developer security training.

Required Qualifications

Technical Experience
3+ years of hands-on experience in application security, penetration testing, offensive security engineering, or closely related roles.
Strong understanding of web application and API security, including the OWASP Top 10 and OWASP API Security Top 10.
Proven experience identifying and exploiting business logic vulnerabilities beyond conventional security findings.
Strong knowledge of authentication, authorization, session management, and trust boundaries.
Practical understanding of distributed systems, state machines, asynchronous workflows, concurrency, and database transaction behavior.
Familiarity with DevSecOps practices and integrating security testing into CI/CD pipelines.
Proficiency in at least one scripting or programming language, preferably Python, Go, JavaScript/TypeScript, or Java.
Experience with Burp Suite, HTTP protocol analysis, API testing, and advanced request manipulation.

Security Engineering Knowledge
Secure Software Development Lifecycle (SSDLC)
Offensive security methodologies and threat modeling
Business logic and system integrity testing
Distributed application architectures and microservices
Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities and concurrency security
State machine and workflow security
Idempotency, replay protection, and transaction atomicity
Security observability and application logging

What Makes an Ideal Candidate?
We are looking for someone who goes beyond identifying SQL injection, XSS, and other conventional vulnerabilities. The ideal candidate is someone who:
Can analyze complex business workflows and identify ways to violate their security assumptions.
Understands how multiple individually legitimate API calls can be combined into an exploitable attack chain.
Can discover security weaknesses arising from concurrency, asynchronous processing, and inconsistent application states.
Understands the difference between successful API calls and their actual business-level impact.
Can identify opportunities to bypass financial, transactional, or approval controls in fintech systems.
Uses logs, distributed tracing, and Application Performance Monitoring (APM) data to understand application behavior and investigate potential exploitation paths.
Can transform manual offensive security findings into automated security controls and detection mechanisms.
Combines an attacker's mindset with strong software engineering skills and codebase knowledge.

Nice to Have
Semgrep: Familiarity with custom security rules, static analysis, CI/CD integration, and application-specific vulnerability detection.
DefectDojo: Familiarity with vulnerability aggregation, deduplication, prioritization, remediation tracking, and security reporting.
Trivy: Familiarity with container image scanning, dependency vulnerability identification, infrastructure-as-code scanning, and security misconfiguration detection.
Tetragon: Familiarity with eBPF-based runtime security observability, process monitoring, and runtime threat detection.