over 1 year ago
Responsibilities
- Conduct code audits across internal applications and infrastructure.
- Perform penetration tests across AWS cloud environments, infrastructure, and backend applications.
- Lead red team exercises and collaborate with detection engineering, threat intelligence, and incident response teams to improve security controls and detection coverage.
- Build and maintain offensive security tools, scripts, and automation frameworks.
- Provide offensive security expertise during incident investigations, including log analysis and root cause reviews.
- Research evolving threats, vulnerabilities, and attack methods and share findings internally and with the security community.
- Own offensive security projects from start to finish and mentor junior team members.
Requirements
- At least 5 years of experience in offensive security, penetration testing, red teaming, or a closely related field.
- Extensive experience conducting code audits to identify and remediate security issues.
- Experience with binary exploitation and mastery of AWS attack techniques and configuration weaknesses.
- Strong understanding of adversary tactics and frameworks such as MITRE ATT&CK.
- In-depth knowledge of web application security, including OWASP Top 10, ASVS, and common vulnerability categories.
- Proficiency with offensive security tools such as Burp Suite and nuclei.
- Strong programming skills in Python, Go, or similar languages, including experience developing tools or automation.
- Excellent written and verbal communication skills for presenting clear, risk-focused technical recommendations.
- Preferred experience includes Web3 or blockchain security, smart contract auditing, bug bounty hunting, Ethereum L1/L2 node architecture, and blockchain infrastructure penetration testing.
Benefits
- Remote-first global workforce with a New York office; the role cannot be performed in California or Colorado.
- Professional reimbursement program for industry conferences, certifications, and related expenses.
- Medical, dental, and vision coverage in the US and some other countries.
- 401(k) retirement plan with company match for US employees.
- Wellness stipend.
- Home office setup and ergonomic equipment program.
About Offchain
Offchain Labs builds the Arbitrum suite of Ethereum scaling technologies, including the Arbitrum One layer-2 network and tools for launching custom chains used by hundreds of web3 projects. It also maintains the Prysm Ethereum client and offers account abstraction infrastructure through ZeroDev, supporting developers and institutions. Privately held and headquartered in New York, the company was founded in 2018.