Senior Attack Engineer, OCI

The role

You will build OCI attack content from the ground up for the NodeZero platform. This involves researching Oracle Cloud services, identifying attack paths, and developing offensive capabilities.

What you will do

• Conduct research into OCI attack paths, identity and trust relationships, service misconfigurations, and emerging attacker techniques.
• Design, implement, and validate production-quality Python attack capabilities.
• Chain individual weaknesses into realistic attack paths.
• Build and maintain safe, repeatable attack logic and supporting tests.
• Collaborate with software engineers, attack engineers, and offensive security SMEs.
• Practice rigorous software development practices to implement OCI-based attack paths.

Required qualifications

• Hands-on experience with OCI security and offensive cloud operations.
• Ability to reason about IAM permissions, service identities, trust, and resource access.
• Advanced understanding of cloud attack paths and cloud-native security concepts.
• Python engineering skills and experience turning security research or manual techniques into production quality automation or product capabilities.
• Passion for building products, not just finding vulnerabilities.
• 4+ years of professional software engineering and or/ offensive security experience.
• Experience with cloud penetration testing, red teaming, offensive security research, or building cloud security products.
• Documented history of collaboration with diverse engineering teams to develop products as an individual contributor.

Nice to have

• Experience with cloud privilege escalation and identity attacks.
• Familiarity with AWS, Azure, or GCP offensive security.
• Experience integrating security research into production software.
• Experience with OKE, Kubernetes, Terraform, Oracle Cloud APIs, or cloud-native CI/CD.
• Contributions to security research, open-source projects, conference talks, or vulnerability disclosure.
• Experience mapping cloud attack coverage to frameworks such as MITRE ATT&CK for Cloud.

Benefits

• Equity package in the form of stock options
• Health, vision & dental insurance for you and your family
• Flexible vacation policy
• Generous parental leave

About the company

Horizon3.ai is a fast-growing, remote cybersecurity company dedicated to enabling organizations to proactively find, fix and verify exploitable attack vectors. The team is a fusion of former U.S. Special Operations cyber operators, startup engineers and operators, and formerly frustrated cybersecurity practitioners.