206K–243K USD / year
Senior Attack Engineer, External
OtherRemote — United States
Published on 2026-10-19
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Build scalable, production-safe autonomous reconnaissance and attack workflows for NodeZero’s external attack capabilities. The role focuses on turning complex external data and multi-step offensive tradecraft into reliable product features.
About the company
Horizon3.ai is a technology company specializing in cybersecurity solutions, focusing on automated penetration testing and threat detection for enterprises. They provide a range of services aimed at enhancing security posture and risk management for organizations across various sectors.
The team
Proactive Offense, External Attack
Stack
Python
What you'll do
- Build and maintain scalable workflows to discover, enumerate, and fingerprint external assets and services.
- Parse and enrich large volumes of messy external data into accurate, actionable information.
- Extend attack-path models to represent identity, privilege, and relationship paths.
- Automate multi-step attack workflows from discovery through post-exploitation.
- Research emerging external tradecraft and ship it as production attack content.
- Maintain test environments and validate attack scenarios safely at scale.
- Mentor teammates and contribute to team standards and coverage priorities.
What we're looking for
- At least five years of offensive security, security research, or security-focused software engineering experience.
- Hands-on external attack experience from reconnaissance through initial access and post-exploitation.
- Experience building reconnaissance and discovery systems that operate at scale.
- Strong Python and production software engineering skills.
- Experience analyzing unstructured external data and connecting high-volume data as relationships.
- Knowledge of identity-focused tradecraft, including credentials, tokens, SSO, and federation.
- Experience automating end-to-end, multi-step attack workflows.
- Strong research, communication, and technical documentation skills.
Nice to have
- OSCP, OSEP, CRTO, or equivalent offensive certification.
- Experience with certificate transparency, passive DNS, or internet-wide scanning.
- Experience with cloud, SaaS, and hybrid identity attack surfaces.
- Experience with graph databases, attack-path analysis, or high-volume data systems.
- Public contributions such as open-source tools, technical writing, talks, or CVEs.
Benefits
- Stock options
- Health, vision, and dental insurance for employees and families
- Flexible vacation policy
- Generous parental leave