Senior Attack Engineer, External

The role

You will develop complex workstreams within the external attack domain for the NodeZero autonomous pentesting platform. This involves designing scalable reconnaissance workflows and automating multi-step attack paths using Python.

What you will do

• Design, build, and maintain highly scalable reconnaissance workflows in Python
• Research, explore, and parse large volumes of external-facing data
• Develop approaches to data that is hard to reason about in code
• Collect, store, and connect high volumes of information to extend attack-path modeling
• Traverse identity relationships across the external surface
• Automate multi-step attack workflows that chain discovery and exploitation
• Research emerging external tradecraft and turn it into production attack content
• Stand up and maintain representative test environments
• Build for production safety and scale
• Contribute to priorities and the coverage roadmap

Required qualifications

• Deep, hands-on offensive experience against external attack surfaces
• 5+ years of hands-on experience in offensive security, security research, and/or security-focused software engineering
• Recent work building and shipping offensive tooling
• Demonstrated experience building reconnaissance and discovery systems that run at scale
• Skill at researching and parsing large amounts of messy, unstructured external data
• Experience collecting, storing, and connecting high volumes of data
• Command of identity-focused tradecraft
• Experience automating multi-step attack workflows end to end
• Strong software engineering fundamentals with Python
• Track record of shipping and maintaining production-quality code
• Ability to independently research unfamiliar systems and technologies
• Strong written and verbal communication

Nice to have

• OSCP (or OSEP, CRTO, or equivalent offensive certifications)
• Experience with large-scale internet data sources and tooling
• Experience with cloud, SaaS, and hybrid identity attack surfaces
• Experience with external to internal pivoting
• Experience with graph databases and attack-path analysis
• Experience with data lake or high-volume data storage and processing
• Experience developing or contributing to offensive or recon tooling
• Public contributions to the field: open-source tools, technical blog posts, conference talks, or published CVEs
• Experience building production-safe autonomous or automated offensive tooling

Benefits

• Equity package in the form of stock options
• Health, vision & dental insurance for you and your family
• Flexible vacation policy
• Generous parental leave

About the company

Horizon3 is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find, fix and verify exploitable attack vectors. The team is a fusion of former U.S. Special Operations cyber operators, startup engineers, and cybersecurity practitioners.