15 hours ago
Remote, United StatesSenior
Base Salary
$184k - $250k/yr
Responsibilities
- Plan and execute internal penetration tests across applications, APIs, cloud infrastructure, and corporate systems, prioritizing work by risk and business impact.
- Define testing scope and rules of engagement, assess production risk, and select safe vulnerability-validation methods.
- Combine hands-on testing with source-code review and architectural analysis to identify vulnerabilities and demonstrate realistic attack paths.
- Partner with engineering teams through findings, remediation, and retesting, and maintain knowledge of Liftoff’s systems and attack surface.
- Build reusable security testing tools, automated testing workflows, self-service assessments, and remediation-validation processes.
- Support annual third-party penetration testing and coordinate findings through remediation.
- Evaluate and implement AI-assisted offensive security workflows for code analysis, test generation, and finding triage.
- Partner with Detection & Response on detection improvements and incident-response exercises.
- Participate in the security team’s on-call and incident-response rotation, including occasional off-hours response and post-incident follow-up.
Requirements
- 5+ years of relevant security engineering experience, including substantial hands-on penetration testing of applications and infrastructure.
- Experience independently owning assessments from planning through remediation and retesting, while safely validating vulnerabilities and assessing production impact.
- Ability to write production-quality code for security tools and automation, review pull requests, navigate large codebases, and validate proof-of-concept and AI-generated code.
- Strong understanding of application and API security, authentication and authorization, network security, and common vulnerability classes.
- Hands-on experience assessing cloud and infrastructure security, including identity and access controls, configuration, and attack paths.
- Ability to understand complex systems and architectures and contribute across application, cloud, and infrastructure security.
- Familiarity with testing, observability, version control, peer code review, continuous integration, and blameless postmortems.
- Strong technical writing and communication skills for assessment plans, findings, runbooks, post-incident reviews, exploitability, and business impact.
- Willingness to participate in on-call and incident-response responsibilities, including occasional off-hours response.
- Preferred experience with Go, Python, Clojure, or JavaScript.
- Preferred experience building AI-assisted security testing workflows and measuring their accuracy and usefulness.
- Preferred experience securing large-scale cloud systems, mobile advertising, or high-volume SaaS environments.
Benefits
- Benefits may include medical coverage, wellness stipends, equity, and additional perks based on country of residence.
- Liftoff describes a fast-paced, collaborative, and innovative work environment with opportunities to grow and make an impact.
Tech Stack
Categories
About Liftoff
Liftoff builds an AI-driven performance marketing and monetization platform for mobile apps, used by both marketers and publishers. Its products—including Accelerate, Direct, Monetize, Intelligence, and Vungle Exchange—support user acquisition, retargeting, and programmatic demand. Founded in 2012 and headquartered in Redwood City, CA, Liftoff is owned by Blackstone and reports serving over 6,600 mobile businesses across 74 countries.