Senior/Staff Attack Engineer, Rapid Response

The role

You will research and productize real-world exploitation techniques for the Rapid Response product. You will turn vulnerability research and attacker tradecraft into safe, repeatable, automated attack capabilities.

What you will do

• Research and reproduce high-consequence vulnerabilities across enterprise networks, applications, identity systems, cloud environments, and infrastructure
• Study attacker tactics, techniques, procedures, and campaigns observed in the wild
• Turn vulnerability research and real-world attacker behavior into safe, repeatable proof-of-exploit capabilities, attack paths, and automated modules
• Demonstrate realistic impact including privilege escalation, credential access, lateral movement, persistence, and data access
• Validate remediation and containment by safely retesting vulnerabilities and security controls
• Improve execution speed, reliability, observability, and evidence quality

Required qualifications

• Strong Python and software engineering skills
• Experience building, testing, and operating production-quality tooling
• Solid penetration testing, vulnerability research, and exploit-development fundamentals
• Hands-on experience with enterprise networks, applications, identity systems, cloud environments, or endpoint security
• Demonstrated ability to reproduce vulnerabilities and convert manual techniques into reliable automation
• Understanding of common attack chains, trust boundaries, authentication and authorization, privilege escalation, and lateral movement
• Ability to balance speed, safety, reliability, coverage, and actionable evidence
• Curiosity about how attackers exploit newly disclosed vulnerabilities
• Strong ownership, judgment, and communication skills

Nice to have

• Experience with CISA KEVs, CVE analysis, N-Day research, Zero-Day research, or responsible disclosure
• Background in incident response, threat hunting, purple teaming, or security operations
• Experience with AWS, Azure, GCP, Kubernetes, Active Directory, Entra ID, Okta, or hybrid environments
• Experience with exploit development, reverse engineering, malware analysis, or vulnerability research
• Contributions to security research, CVEs, conference talks, open-source tools, or technical publications
• CTF experience or equivalent hands-on offensive security practice
• Bachelor’s Degree in Computer Science, Computer Engineering or related field
• OSCP (Offensive Security Certified Professional) or equivalent certifications

Benefits

• health, vision & dental insurance for you and your family
• flexible vacation policy
• generous parental leave
• equity package in the form of stock options

About the company

Horizon3 is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find and fix and verify exploitable attack vectors. Their flagship product, the NodeZeroTM platform, delivers production-safe autonomous pentests.