238K–280K USD / year
Engineering Manager, Internal Attack
Engineering managerRemote — United States
Published on 2026-11-05
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead the team responsible for NodeZero’s internal attack capabilities, turning offensive security research into reliable, autonomous product features. Set technical direction, develop the team, and ensure attacks are safe to run across customer production environments.
About the company
Horizon3.ai is a technology company specializing in cybersecurity solutions, focusing on automated penetration testing and threat detection for enterprises. They provide a range of services aimed at enhancing security posture and risk management for organizations across various sectors.
The team
Internal Attack Engineering, within the Proactive Offense and Core Attack teams.
Stack
PythonActive DirectoryLinuxUnixEntra IDSCCMNeo4jnmap
What you'll do
- Lead, hire, coach, and develop attack and backend engineers.
- Set the roadmap for internal and Active Directory attack coverage.
- Guide attack research across identity, lateral movement, hosts, databases, and network infrastructure.
- Establish production-safety, testing, code-review, and observability standards.
- Coordinate attack-path graph and data-model work with partner engineering teams.
- Own on-call and customer escalations, driving triage and durable fixes.
- Support customer briefings, go-to-market enablement, and external research.
What we're looking for
- At least 2 years managing offensive security, red-team, or attack-engineering teams.
- At least 8 years of combined offensive security and software engineering experience.
- Hands-on Active Directory and internal enterprise network attack experience.
- Working knowledge of modern AD tradecraft and hardened environments.
- Experience with internal attacks beyond AD, including Linux/Unix, databases, and network services or devices.
- Able to review production Python and work with Git, merge requests, and CI/CD.
- Experience turning offensive techniques into automated tools or repeatable product capabilities.
- Sound judgment about safely running offensive techniques in production.
Nice to have
- Experience leading autonomous pentesting or breach-and-attack-simulation product teams.
- Experience with SCCM, Windows Admin Center, or hybrid identity attacks.
- Experience scaling network discovery across large enterprise networks.
- Experience building LLM-powered agents or applying AI to offensive security.
- Familiarity with Neo4j and attack-path analysis.
- OSCP, OSEP, CRTO, or equivalent certification.
- Public contributions such as open-source tools, technical writing, talks, or published CVEs.
- Experience managing a fully remote engineering team.
Benefits
- Stock options
- Health, vision, and dental insurance for employees and family
- Flexible vacation policy
- Generous parental leave