Senior Offensive Security Engineer

The role

The Senior Offensive Security Engineer will mature the in-house Offensive Security program. This person will lead red and purple team operations, conduct penetration tests, and identify attack paths in identity infrastructure.

What you will do

• Lead the build out of red and purple team operations.
• Lead internal and external network and infrastructure penetration tests across enterprise and product environments.
• Identify and exploit attack paths in identity infrastructure.
• Perform source code review in support of testing engagements.
• Create or reproduce and demonstrate proof-of-concept exploits.
• Plan and execute penetration testing engagements from beginning to end.
• Perform manual and automated security testing of web applications, APIs, desktop and agent-based clients, and cloud services.
• Write clear, well-supported penetration test reports.
• Partner with Product Development, DevOps, and IT teams to explain findings and validate remediation.
• Develop and maintain custom tools, scripts, and automation.

Required qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent work experience.
• Minimum 3+ years of demonstrated, hands-on experience with internal and external web application, API, and network penetration testing.
• Understanding of penetration testing methodology and frameworks (MITRE ATT&CK, OWASP, PTES).
• Hands-on experience with industry-standard offensive tooling, such as Burp Suite, Nmap, Metasploit, BloodHound, and Impacket.
• Experience testing identity and authentication mechanisms, including Active Directory, Entra ID, Kerberos, OAuth 2.0, OpenID Connect, and SAML.
• Proficiency in at least one scripting or programming language, such as Python, Go, or PowerShell.
• Ability to read and review source code in common languages, such as C#, Java, or JavaScript/TypeScript.
• Experience with Azure and AWS cloud-based infrastructure.
• Understanding of the Secure Software Development Lifecycle (SSDLC).
• Skill in illustrating and explaining security vulnerabilities to audiences with minimal expertise in security.
• Ability to manage multiple engagements concurrently and meet deadlines with minimal supervision.

Nice to have

• One or more of the following certifications: ARTE, BSCP, CARTS, CRTL, CRTO, CRTP, eCPPT, eWPT, GPEN, GWAPT, OSCP, OSEP, OSWE, Pentest+, PNPT.
• Experience with command-and-control frameworks, such as Cobalt Strike, Sliver, or Mythic, and adversary emulation.
• Experience testing containerized and cloud-native environments, including Kubernetes, infrastructure-as-code, and CI/CD pipeline security.
• Experience testing identity and access management, privileged access management, or secrets management products.
• Experience using AI and LLM-based agents and tooling in testing methodologies and testing AI and LLM-based features and agents.
• Published CVEs, bug bounty participation, CTF competition, or other public security research contributions.
• Experience working with high-security environments subject to regulations such as FedRAMP or ITAR.
• Excellent analytical and problem-solving skills with a keen attention to detail.

Benefits

• Competitive salaries
• Meaningful bonus program
• Healthcare insurance
• Pension/retirement matching
• Comprehensive life insurance
• Employee assistance program
• Time off plans
• Paid company holidays

Before you apply

• Delinea is not considering candidates that need any type of US work authorization now or in the future.
• Candidates are required to complete comprehensive criminal background check.
• Verification of education is required.
• Verification of employment is required.
• Publicly posted social media sites may be reviewed.

About the company

Delinea is the identity security platform that continuously controls what AI agents, humans and machines can do and for how long.