Security Engineer II (Offensive Operations)

Description

This role is on the Active Operational Offensive track of the security team, where you will work under senior engineers and sit at the center of the company's security defenses.

The track connects manual penetration testing with live security operations and is meant to build the skills needed to lead independent engagements over time.

The company provides global payments enablement and software. It was founded more than ten years ago and has grown into new regions and industry verticals.

It supports over 5,100 clients in education, healthcare, travel and B2B, with payment methods in 240 countries and territories and more than 140 currencies.

The company has over 1,400 employees from more than 40 nationalities, spread across 15 offices worldwide.

Interview steps include meetings with the Hiring Manager, team peers and the VP of the department, plus a skills assessment. A Talent Acquisition Partner guides you through the process and is your main contact for questions.

Responsibilities

• Run hands-on internal and external penetration tests across AWS and multicloud environments to find vulnerabilities, misconfigurations and paths to higher privileges.
• Test web applications and REST and GraphQL APIs in depth, looking for flaws in business logic, authentication bypasses and OWASP Top 10 risks.
• Review SAST and DAST results and perform focused code audits in Python, Java and Ruby, removing false positives and prioritizing the most serious fixes.
• Work alongside the Blue Team in adversary emulation exercises to test security controls, improve SIEM detection rules and tune real-time alerts.
• Take part in goal-driven adversarial simulations that assess the company's physical and digital security and its incident response readiness.
• Manage the external vulnerability disclosure and bug bounty programs by triaging reports, confirming severity and getting engineering fixes out quickly.
• Apply the tactics of newly observed threat actors and keep testing methods aligned with the MITRE ATT&CK framework.
• Give Engineering, SRE and IT teams practical remediation advice that balances strong security fixes with the pace of the business.

Requirements

• A Bachelor of Science degree and at least 2+ years of experience in IT security and penetration testing.
• A proven record of carrying out network, web application and API penetration tests.
• Skill with Kali Linux and both commercial and open-source penetration tools, plus active work on bug bounty platforms.
• Experience with SAST and DAST tools and secure code reviews, with scripting ability in Python, Java or Ruby.
• Working knowledge of AWS cloud infrastructure, Agile teams, CI/CD pipelines and Infrastructure as Code (IaC).
• Solid understanding of OWASP methods, threat types such as malware, intrusion and DoS, and platform security strategy.
• Strong technical writing skills, both formal and informal, and the ability to explain complex exploit chains to non-technical stakeholders.
• Preferred certifications (nice-to-have): OSCP, OSCE or SANS GXPN for offensive and red team work, and OffSec OSAI (Offensive Security AI Red Teamer) for AI security.
• Mindset: you combine an attacker's drive to break systems with a defender's discipline in building useful SIEM detection rules.
• You stay analytical and calm during live breaches or tight release deadlines.
• You weigh risk reduction against the growth of the organization.

Conditions

The base salary range listed for this role is $0-$0.

The range reflects the minimum and maximum target for new hire salaries across all US locations. Individual pay depends on work location and other factors such as job-related skills, experience, education and training.

The role is based in the US, and the posted salary range applies to US locations.

Benefits

• Competitive pay.
• Employee Stock Purchase Plan (ESPP).
• Competitive time off.
• Opportunities to work with talented people around the world.
• Wellbeing programs covering mental health, wellness, and yoga, Pilates and HIIT classes, run with colleagues worldwide.
• A chance to make a visible difference to the company's success.
• Talent and development programs, including Managers Taking Flight for new or aspiring managers and OneFlywire Career Mobility.