2 days ago
Base Salary
$160k - $305k/yr
Responsibilities
- Plan and run objective-based red team and adversary emulation operations against cloud, corporate, and production environments.
- Conduct purple team exercises with Security Operations to improve detection and response.
- Perform deep security testing of web applications, APIs, Unity products, game clients, developer platforms, ads and monetization systems, and infrastructure.
- Identify and demonstrate attack paths across GCP, AWS, Azure, Kubernetes, containers, CI/CD pipelines, identity systems, and secrets.
- Test LLM integrations, AI-native products, and agent workflows for prompt injection, data leakage, tool misuse, and excessive permissions.
- Write prioritized findings, explain realistic business impact, collaborate on remediation, and retest fixes.
- Build and maintain offensive security tools, scripts, and automation for scalable testing and continuous checks.
Requirements
- 6+ years of experience in offensive security, including red teaming, penetration testing, purple teaming, or vulnerability research, and leading engagements end to end.
- Hands-on experience attacking cloud environments such as GCP, AWS, or Azure, including identity, Kubernetes, containers, and CI/CD.
- Strong web application and API security testing skills, including identifying logic flaws beyond scanner results.
- Scripting or programming ability in languages such as Python, Go, or C/C++ to build tools and exploits.
- Experience conducting adversary emulation or red team operations against realistic objectives and working with defenders in purple team exercises.
- Clear written and verbal communication skills for explaining technical risk to engineers and non-technical leaders.
- Preferred experience includes testing LLM products, AI agents, or AI-assisted developer tools; reverse engineering; binary exploitation; game client or anti-cheat security; gaming, ad tech, or large developer-facing platforms; bug bounties; CVEs; conference talks; published research; or open-source security tooling.
- OSCP, OSEP, OSWE, or CRTO certifications are useful but do not substitute for a demonstrated track record.
Benefits
- Benefits vary by country and employment status and may include health, life, and disability insurance, commute subsidy, employee stock ownership, retirement or pension plans, vacation and personal days, parental and family-care leave, office food and snacks, mental health programs, employee resource groups, employee assistance, training and development, and volunteering and donation matching.
- The role may be eligible for equity awards and company incentive plans in addition to base salary.
Categories
About Unity
Unity is a public software company that builds the Unity real-time 3D engine and services for creating, operating, and monetizing games and interactive 3D content across mobile, PC, console, and XR. It sells subscription licenses and usage-based services such as cloud build, ads, and analytics to studios and enterprises in gaming, automotive, film, and AR/VR. Founded in 2004 and headquartered in San Francisco, it trades on the NYSE (U).