Senior Offensive Security Engineer

Description

The company is a diversified trading firm with over 30 years of experience. It trades its own capital and takes on its own risk.

Headquartered in Chicago, it has offices across the U.S., Canada, Europe and Asia. It trades fixed income, ETFs, equities, FX, commodities and energy in major markets worldwide.

Beyond trading, it has expanded into real estate, venture capital and cryptoassets.

The company is building out its offensive security capability and wants a senior engineer to lead it.

You will act as a trusted attacker, finding and fixing weaknesses before anyone else can. The work is hands-on and depends on high trust.

Responsibilities

• Run red team engagements and adversary simulations against trading systems, corporate IT and cloud environments, using realistic attacker TTPs mapped to frameworks such as MITRE ATT&CK.
• Build and adapt custom tools, scripts and exploits to mimic adversary behavior, test control effectiveness and check detection coverage.
• Carry out penetration tests on networks, web and internal applications, APIs and cloud infrastructure, then write reports with clear, practical remediation guidance.
• Work with infrastructure, platform and application owners to validate, prioritize, track and close vulnerabilities and control weaknesses.
• Join the Security Engineering and SOC teams in purple-team exercises to narrow the gap between what attackers can reach and what defenders can see.
• Explain results and risk to technical teams and senior leadership in a way that prompts action.
• Run phishing and social engineering simulations to assess and improve staff security awareness.
• Track the threat landscape, new TTPs and offensive tooling, and apply what you learn to the company's defenses.
• Test AI and LLM-integrated systems for prompt injection, model manipulation, data poisoning and misuse of agentic workflows, and help teams harden them.
• Use AI-assisted tools to speed up reconnaissance, vulnerability discovery and exploit development, and evaluate new AI-powered offensive techniques.
• Help define and mature the offensive security methodology, standards and tooling, and mentor other engineers on the security team.

Requirements

• At least 5 years of hands-on experience in offensive security, penetration testing or red teaming, covering the full engagement lifecycle: reconnaissance, initial access, privilege escalation, lateral movement, persistence and exfiltration.
• Strong scripting or programming skills for building and adapting offensive tools.
• Solid understanding of networking, Windows, macOS and Linux internals, identity providers and cloud platforms.
• Practical use of common offensive tools such as Cobalt Strike, Metasploit, BloodHound, Burp Suite and Nmap, and a record of building your own tools when needed.
• Working knowledge of MITRE ATT&CK, adversary emulation and detection evasion, plus enough understanding of defensive controls to help defenders improve.
• A record of clear, precise reporting and the ability to turn technical findings into risk that engineers and executives both understand.
• Experience with smart contract auditing and blockchain security.
• Familiarity with AI and ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tools.
• A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws.