Staff Attack Engineer, External
Horizon3 AI4 hours ago
Remote, United StatesStaff+
Base Salary
$238k - $280k/yr
Responsibilities
- Design, build, and maintain scalable Python reconnaissance workflows for discovering, enumerating, and fingerprinting external-facing assets and services.
- Research and parse large volumes of unstructured external data and turn it into accurate, actionable information.
- Build data parsing, enrichment, storage, and relationship models for identities, assets, privileges, and attack paths.
- Automate multi-step workflows spanning discovery, credential access, initial access, and post-exploitation.
- Research emerging external offensive techniques and convert them into safe production attack content.
- Create and maintain test environments for validating, demonstrating, and regression-testing attack scenarios.
- Design for production safety, scale, rate limits, and customer environment boundaries across large attack surfaces.
- Set research, content, and coverage priorities using customer environments, threat intelligence, and emerging techniques.
- Mentor attack engineers and improve code quality, research rigor, and operational safety.
- Collaborate with engineering, product, and customer-facing teams and author technical documentation, research, and blog posts.
Requirements
- 10+ years of hands-on experience in offensive security, security research, or security-focused software engineering.
- Deep hands-on offensive experience across external attack surfaces from reconnaissance through initial access and post-exploitation.
- Recent experience building and shipping production-quality offensive tooling and scalable reconnaissance or discovery systems.
- Strong ability to research and parse large volumes of messy, unstructured external data.
- Experience collecting, storing, and connecting high-volume data involving identities, assets, trust, and relationships.
- Command of identity-focused tradecraft, including credential access, password and token attacks, SSO and federation weaknesses, and identity or tenant movement.
- Experience automating complete multi-step attack workflows.
- Strong software engineering fundamentals in Python and experience maintaining production-quality code.
- Ability to independently research unfamiliar systems and technologies and become a subject-matter expert.
- Strong written and verbal communication skills, including technical documentation.
- OSCP, OSEP, CRTO, or equivalent offensive security certification is preferred.
- Experience with certificate transparency, passive DNS, internet-wide scanning, cloud and SaaS identity attack surfaces, Entra ID, Okta, AWS, graph databases, attack-path analysis, datalakes, or high-volume data processing is preferred.
- Public contributions such as open-source tools, technical blog posts, conference talks, or published CVEs are preferred.
Benefits
- Fully remote work model with up to 5% travel required.
- Health, vision, and dental insurance for employees and families.
- Flexible vacation policy and generous parental leave.
- Equity package in the form of stock options for all full-time roles.
- Growth opportunities and an inclusive, collaborative culture.
About Horizon3 AI
Horizon3 AI builds NodeZero, a proactive security platform that autonomously performs penetration testing and validates attack paths across on‑prem, cloud, and hybrid environments. The company sells its software by subscription to security and IT teams at enterprises and government agencies, helping prioritize and verify fixes. Founded in 2019 and headquartered in San Francisco, it is privately held and serves customers across regulated industries and the public sector.