Staff Attack Engineer, External

The role

You will be a technical leader for external attack capabilities in the NodeZero autonomous pentesting platform. You will design and maintain scalable reconnaissance workflows and automate multi-step attack workflows using Python.

What you will do

• Design, build, and maintain highly scalable reconnaissance workflows in Python.
• Research, explore, and parse large volumes of external-facing data.
• Develop approaches to data such as free-form banners, web content, documents, and error output.
• Collect, store, and connect high volumes of information to extend attack-path modeling.
• Traverse identity relationships across the external surface to find paths to compromise.
• Automate multi-step attack workflows that chain discovery, credential access, and post-exploitation.
• Research emerging external tradecraft and turn it into production attack content.
• Stand up and maintain representative test environments to validate attack scenarios.
• Set priorities and the coverage roadmap based on customer environments and threat intelligence.
• Mentor and level up attack engineers and raise the bar on code quality.

Required qualifications

• Deep, hands-on offensive experience against external attack surfaces.
• 10+ years of hands-on experience in offensive security, security research, or security-focused software engineering.
• Recent work building and shipping offensive tooling.
• Demonstrated experience building reconnaissance and discovery systems that run at scale.
• Skill at researching and parsing large amounts of messy, unstructured external data.
• Experience collecting, storing, and connecting high volumes of data.
• Command of identity-focused tradecraft.
• Experience automating multi-step attack workflows end to end.
• Strong software engineering fundamentals with Python.
• Track record of shipping and maintaining production-quality code.
• Ability to independently research unfamiliar systems and technologies.
• Strong written and verbal communication.

Nice to have

• OSCP (or OSEP, CRTO, or equivalent offensive certifications)
• Experience with large-scale internet data sources and tooling, such as certificate transparency, passive DNS, and internet-wide scanning
• Experience with cloud, SaaS, and hybrid identity attack surfaces (Entra ID, Okta, AWS, and similar)
• Experience with external to internal pivoting
• Experience with graph databases and attack-path analysis, and with datalake or high-volume data storage and processing
• Experience developing or contributing to offensive or recon tooling
• Public contributions to the field: open-source tools, technical blog posts, conference talks, or published CVEs
• Experience building production-safe autonomous or automated offensive tooling

Benefits

• Equity package in the form of stock options
• Health, vision & dental insurance for you and your family
• Flexible vacation policy
• Generous parental leave

About the company

Horizon3 is a fast-growing, remote cybersecurity company dedicated to enabling organizations to proactively find and fix exploitable attack vectors. The team is a fusion of former U.S. Special Operations cyber operators, startup engineers, and formerly frustrated cybersecurity practitioners.