Senior Offensive Security Engineer

Description

The company is a diversified trading firm with more than 30 years of experience. It trades its own capital and takes its own risk, valuing autonomy and the speed to seize opportunities.

Based in Chicago with offices across the U.S., Canada, Europe and Asia, the firm trades fixed income, ETFs, equities, FX, commodities and energy in major global markets. It also invests in real estate, venture capital and cryptoassets.

The company is building out its offensive security function and wants a Senior Offensive Security Engineer to lead it. The role is hands-on and high-trust, and it works alongside the security, infrastructure and trading teams to turn findings into fixes.

Responsibilities

• Help define and mature the offensive security methodology, standards and tooling, and mentor other engineers on the security team.
• Plan and run red team engagements and adversary simulations against trading systems, corporate IT and cloud environments, modeling realistic TTPs mapped to MITRE ATT&CK.
• Carry out penetration tests across networks, web and internal applications, APIs and cloud infrastructure, then report findings with clear remediation steps.
• Write custom tools, scripts and exploits that emulate attacker behavior, test control effectiveness and check detection coverage.
• Partner with the Security Engineering and SOC teams in purple-team exercises to close the gap between what attackers can do and what defenders can see.
• Run social engineering and phishing simulations to strengthen security awareness across the organization.
• Find, validate, rank and track vulnerabilities and control weaknesses until owners in infrastructure, platform and application teams remediate them.
• Explain engagement results and risk to technical teams and senior leaders in a way that prompts action.
• Track the threat landscape, new TTPs and offensive tooling, and apply what you learn to the company's defenses.
• Assess AI and LLM-integrated systems for prompt injection, model manipulation, data poisoning and abuse of agentic workflows, and help the teams building them harden those systems.
• Use AI-assisted tooling to speed up reconnaissance, vulnerability discovery and exploit development, and evaluate new AI-powered offensive techniques as they appear.

Requirements

• 5+ years of hands-on experience in offensive security, penetration testing or red teaming, covering reconnaissance, initial access, privilege escalation, lateral movement, persistence and exfiltration.
• Strong scripting or programming skills for building and adapting offensive tools.
• Solid understanding of networking, Windows, macOS and Linux internals, identity providers and cloud platforms.
• Practical experience with common offensive tools such as Cobalt Strike, Metasploit, BloodHound, Burp Suite and Nmap, and a record of building your own tools when needed.
• Working knowledge of MITRE ATT&CK, adversary emulation and detection evasion, plus enough understanding of defensive controls to help defenders improve.
• A track record of clear, precise reporting and communication, turning technical findings into risk that engineers and executives both understand.
• Experience with smart contract auditing and blockchain security.
• Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling.
• A collaborative mindset that treats red teaming as a way to make the whole organization more secure, not only a way to find flaws.

Conditions

The annual base salary range is $175,000 to $275,000, depending on experience, qualifications and relevant skill set.

The position is eligible for an annual discretionary bonus.

Benefits

• Group medical, pharmacy, dental and vision insurance.
• 401k with a discretionary employer match.
• Short- and long-term disability, plus life and AD&D insurance.
• Health savings accounts and flexible spending accounts.