3 days ago
Base Salary
$183k - $200k/yr
Responsibilities
- Lead risk-prioritized penetration testing and offensive security assessments across products, web applications, APIs, infrastructure, cloud, identity, SaaS, and enterprise technologies.
- Scope and execute red-team campaigns, adversary simulations, assumed-breach exercises, and purple-team engagements based on threats and business risk.
- Identify, validate, and safely exploit vulnerabilities, chain weaknesses into realistic attack paths, and assess business impact.
- Develop, validate, and operationalize AI-assisted workflows for reconnaissance, campaign development, social engineering, tooling, and analysis.
- Create custom scripts, tooling, payloads, and automation for offensive security engagements.
- Conduct offensive security testing primarily in GCP and modern identity platforms, with relevant testing in AWS, Azure, and Kubernetes.
- Partner with SOC, Detection Engineering, Threat Hunting, and Incident Response teams to validate telemetry, detections, investigations, and response capabilities.
- Work with engineering and defensive teams to prioritize remediation, retest fixes, and verify improvements to logging, monitoring, playbooks, and controls.
- Document findings, attack paths, business impact, and remediation recommendations for technical and executive audiences.
- Own the technical direction and execution of the offensive security roadmap, mature methodologies, mentor practitioners, and measure program effectiveness.
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent experience.
- At least 8 years of relevant information security experience, including significant hands-on penetration testing, red teaming, adversary simulation, or offensive security work.
- Experience independently leading complex penetration tests or offensive security engagements.
- Deep expertise in application/API exploitation, cloud offensive security, identity, or enterprise environments, with working knowledge across other domains.
- Strong knowledge of attacker techniques including initial access, credential access, privilege escalation, persistence, lateral movement, defense evasion, and data access.
- Hands-on experience with at least one major cloud platform and modern identity environments, including Active Directory, SAML, OAuth, OIDC, MFA, and SSO.
- Experience with modern offensive security tooling and frameworks for web, identity, network, and adversary-emulation testing.
- Ability to develop or modify offensive security tooling using Python, PowerShell, Bash, Go, or similar languages.
- Demonstrated experience incorporating AI into offensive security or red-team operations and validating its operational benefits.
- Experience planning or leading purple-team exercises and translating offensive findings into defensive improvements.
- Strong understanding of MITRE ATT&CK and defensive coverage mapping.
- Experience mentoring offensive security engineers, setting technical direction, and influencing engineering and security outcomes.
- Preferred qualifications include offensive security community contributions, internal red-team program development, advanced adversary-emulation experience, AI integrations using agent frameworks or LLM APIs, AI application assessments, SaaS security, endpoint/EDR evasion, exploit development, social engineering, GCP and Kubernetes expertise, and certifications such as OSCP, OSEP, OSWE, OSED, CRTO, or GXPN.
Benefits
- Employees may be eligible for bonus or commission, medical, retirement, financial, wellness, time-off, employee discount, and other benefits.
- The role is located in the United States; compensation and offers depend on experience, education, certifications, skills, and geographic location.
- Employment is contingent on the applicant’s ability to comply with U.S. export controls.
- Alteryx supports a diverse, equitable, and inclusive workplace and encourages qualified applicants who meet some, but not necessarily all, requirements.
Tech Stack
Categories
About Alteryx
Alteryx builds an analytics automation platform used by analysts, data engineers, and data scientists to prepare, blend, and analyze data with code-optional tools. Its products, including Alteryx Designer plus cloud and server offerings, are sold primarily via subscriptions for on-premises and SaaS deployments across enterprises. Founded in 1997 and headquartered in Irvine, California, Alteryx is privately held under Clearlake Capital.