Staff Attack Engineer, Internal/AD

The role

You will serve as the technical lead and subject matter expert for internal network and Active Directory attack capabilities in the NodeZero platform. You will research emerging tradecraft and build production-grade Python to turn manual techniques into autonomous attacks.

What you will do

• Serve as the technical lead and primary subject matter expert for internal-network and Active Directory attack capabilities.
• Research emerging AD and internal tradecraft and turn it into production attack content.
• Design, build, and maintain production-grade Python.
• Focus on modern, hardened environments and build attacks that succeed when easy paths are closed.
• Stand up, configure, and exploit representative AD test environments.
• Extend attack-path modeling and graph data model.
• Set priorities and the coverage roadmap.
• Mentor and level up attack engineers.
• Collaborate cross-functionally with engineers, product managers, and customer-facing teams.
• Author internal documentation and external research and blog posts.

Required qualifications

• Deep, hands-on offensive experience against Active Directory and internal enterprise networks.
• Command of current AD tradecraft: credential access, Kerberos attacks, NTLM coercion and relay, AD Certificate Services abuse, ACL and GPO abuse, and lateral movement and persistence.
• Demonstrated experience attacking modern, hardened environments.
• Strong software engineering fundamentals with expert-level Python.
• Track record of shipping and maintaining production-quality code.
• Ability to independently research unfamiliar systems and technologies.
• Track record of technical leadership.
• Strong written and verbal communication.
• A passion for building products.
• 8+ years of combined offensive security and/or software engineering experience, with significant time focused on Active Directory and internal network attacks.

Nice to have

• OSCP (or OSEP, CRTO, or equivalent offensive certifications)
• Experience with SCCM, Windows Admin Center, and other modern Windows management-plane attack surfaces
• Experience with hybrid identity attacks (Entra ID and Entra Connect, primary refresh tokens, seamless SSO) and on-prem to cloud pivots
• Experience developing or contributing to offensive tooling like BloodHound, Impacket, netexec, etc.
• Familiarity with graph databases (Neo4j) and attack-path analysis
• Experience integrating security research into production, multi-tenant SaaS
• Public contributions to the field: open-source tools, technical blog posts, conference talks, or published CVEs
• Experience building production-safe autonomous or automated offensive tooling

Benefits

• Equity package in the form of stock options
• Health, vision & dental insurance for you and your family
• Flexible vacation policy
• Generous parental leave

About the company

Horizon3 is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find and fix and verify exploitable attack vectors. The team is a fusion of former U.S. Special Operations cyber operators, startup engineers, and formerly frustrated cybersecurity practitioners.