Staff Attack Engineer, Internal/AD
Horizon3 AI2 months ago
Remote, United StatesStaff+
Base Salary
$247k - $275k/yr
Responsibilities
- Lead internal-network and Active Directory attack capabilities across the NodeZero platform as the primary technical subject matter expert.
- Research emerging Active Directory and internal-network attack techniques and turn them into safe, production-ready attack content.
- Design, build, and maintain production-grade Python for autonomous attacks at enterprise scale.
- Develop attacks for hardened environments involving NTLM deprecation, SMB signing, Kerberos-only configurations, tiered administration, LAPS, and managed service accounts.
- Configure and exploit representative Active Directory test environments for validation, demonstration, and regression testing.
- Extend attack-path modeling and graph data models for identity, privilege-escalation, and lateral-movement paths.
- Set research priorities and coverage roadmaps using customer environments, threat intelligence, and emerging techniques.
- Mentor attack engineers and improve code quality, research rigor, and operational safety.
- Collaborate with engineering, product management, and customer-facing teams and write technical documentation, blog posts, and external research.
Requirements
- Deep hands-on offensive experience against Active Directory and internal enterprise networks from initial foothold through domain and enterprise compromise.
- Expert knowledge of Active Directory tradecraft, including credential access, Kerberos attacks, NTLM coercion and relay, AD Certificate Services abuse, ACL and GPO abuse, lateral movement, and persistence.
- Experience attacking modern hardened environments with NTLM deprecation, enforced signing, Kerberos-only configurations, and tiered administration.
- Expert-level Python and strong software engineering fundamentals with a history of shipping and maintaining production-quality code.
- Ability to independently research unfamiliar systems and become a subject matter expert.
- Demonstrated technical leadership in setting direction, driving complex and high-risk work, and mentoring engineers.
- Strong written and verbal communication skills, including technical documentation.
- Passion for building offensive security products rather than only identifying vulnerabilities.
- At least 8 years of combined offensive security and/or software engineering experience, including significant Active Directory and internal-network attack experience.
- Preferred: OSCP, OSEP, CRTO, or an equivalent offensive security certification.
- Preferred: experience with SCCM, Windows Admin Center, hybrid identity attacks, Entra ID, Entra Connect, primary refresh tokens, seamless SSO, and on-premises-to-cloud pivots.
- Preferred: contributions to BloodHound, Impacket, netexec, or similar offensive tooling.
- Preferred: familiarity with Neo4j and attack-path analysis.
- Preferred: experience integrating security research into production multi-tenant SaaS or building production-safe autonomous offensive tooling.
- Preferred: public contributions through open-source tools, technical articles, conference talks, or published CVEs.
Benefits
- Fully remote work arrangement, with up to 10% travel required.
- Health, vision, and dental insurance for employees and their families.
- Flexible vacation policy and generous parental leave.
- Equity package in the form of stock options for full-time roles.
- Inclusive, collaborative culture with career development opportunities.
- Hybrid and remote work models may vary by role and location, including possible regular in-office presence in Chicago.
About Horizon3 AI
Horizon3 AI builds NodeZero, a proactive security platform that autonomously performs penetration testing and validates attack paths across on‑prem, cloud, and hybrid environments. The company sells its software by subscription to security and IT teams at enterprises and government agencies, helping prioritize and verify fixes. Founded in 2019 and headquartered in San Francisco, it is privately held and serves customers across regulated industries and the public sector.