Senior/Lead Security Engineer - AI

We are seeking an experienced Penetration Tester to establish and operate a robust, repeatable security-testing capability for our products and supporting infrastructure. The role will design the penetration-testing framework, toolset, processes, and test environments needed to conduct regular assessments across web applications, APIs, virtual machines, cloud configurations, and related infrastructure. A key objective is to validate defenses against modern attack techniques and maintain high security coverage across the business product offering.

Responsibilities

• Design, implement, and maintain a penetration-testing framework covering methodology, scope definition, test frequency, evidence collection, reporting, retesting, and risk tracking
• Build, configure, and maintain the tools, scripts, environments, and automation required for recurring security assessments
• Perform manual and automated penetration testing of web applications, customer-facing portals, APIs, virtual machines, operating systems, networks, and cloud environments (IAM, storage, networking, logging, secrets, containers)
• Identify vulnerabilities, validate exploitability, assess business impact, and provide practical, prioritized remediation recommendations
• Design attack scenarios reflecting modern attacker behavior, including automated reconnaissance, vulnerability discovery, credential attacks, and attack chaining
• Collaborate with software engineering, DevOps, cloud, infrastructure, product, and security teams to explain findings, support remediation, and confirm fixes through retesting
• Integrate appropriate security testing and scanning into CI/CD pipelines and engineering workflows
• Stay current on vulnerabilities, offensive-security techniques, cloud-security threats, OWASP guidance, and emerging attack trends

Requirements

• 8+ years of hands-on experience in penetration testing, application security, offensive security, red teaming, or a similar role
• Proven experience testing web applications, APIs, cloud infrastructure, virtual machines, operating systems, and network services
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, common web and API attack techniques, and secure-development practices
• Practical experience assessing one or more major cloud platforms: AWS, Microsoft Azure, or Google Cloud Platform
• Strong understanding of identity and access management, authentication, authorization, session security, networking, encryption, secrets management, and common cloud misconfigurations
• Hands-on experience with tools such as Burp Suite, Nmap, Wireshark, Metasploit, Nessus/OpenVAS, sqlmap, and cloud-security tools
• Proficiency in scripting or programming using Python, Bash, PowerShell, JavaScript, or similar languages
• Ability to independently plan and execute tests, document evidence, communicate risk, and deliver concise, actionable technical reports
• Strong communication skills and the ability to work constructively with engineering and business stakeholders

Nice to have

• Experience building internal penetration-testing frameworks, labs, tools, scripts, or security-test automation
• Experience integrating security controls or testing activities into CI/CD pipelines
• Knowledge of Docker, Kubernetes, Terraform, infrastructure as code, and container-security testing
• Relevant certifications such as OSCP, OSWE, OSEP, CRTO, CREST, GPEN, GWAPT, PNPT, CISSP, or cloud-security certifications