WebApp Offensive Security Software Engineer

The role

You will design, develop, and integrate web application penetration testing content into the NodeZero platform. This involves performing full-scope web application penetration tests and translating findings into product improvements.

What you will do

• Perform hands-on, full-scope web application penetration tests.
• Review NodeZero results to identify coverage gaps and missed opportunities.
• Manually reproduce and validate edge cases by building production-safe proof-of-concept exploits.
• Partner with software engineers to translate findings into product improvements.
• Build and maintain a library of regression and benchmark test cases.
• Monitor production pentests for missed findings and false positives.
• Work with customers and internal teams to investigate findings and explain attack paths.
• Author technical blog posts and research write-ups.
• Mentor teammates and contribute to team processes and testing standards.

Required qualifications

• Experience conducting full scope web application pentests
• Experience with proxy tools like Burp and with browser developer tools
• Proficient in object-oriented programming and test-driven development
• Experience applying AI-assisted development tools to security research and automation tasks
• Curiosity about emerging AI technologies
• Skilled in designing, evaluating, and communicating technical solutions across systems, APIs, algorithms, and data structures
• Familiarity with relational and graph databases, particularly Postgres and Neo4j
• Strong written and verbal communication, including technical documentation
• Ability to manage multiple priorities, work independently, and mentor teammates
• Quick to learn and adopt new technologies
• History of recognized security research, including documented CVE discoveries and responsible disclosure
• Track record of successful bug bounty contributions

Nice to have

• Experience developing software and automation to aid in web application pentesting
• Background in large-scale software development projects
• Experience fine-tuning language models or implementing retrieval-augmented generation (RAG) for security-focused applications
• Experience with AI/LLM tools for building agentic workflows (e.g., LangChain, LangFlow) and integrating contextual data using protocols like Model Context Protocol (MCP)
• Demonstrated examples of using AI to enhance or automate exploit development
• OSCP (Offensive Security Certified Professional) Certification

Benefits

• Equity package in the form of stock options
• Health, vision & dental insurance for you and your family
• Flexible vacation policy
• Generous parental leave

About the company

Horizon3 is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find and fix and verify exploitable attack vectors. Their flagship product, the NodeZero platform, delivers production-safe autonomous pentests.