206K–243K USD / year
Senior Attack Engineer, GCP
OtherRemote — United States
Published on 2026-11-06
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead the development of Google Cloud Platform attack capabilities for NodeZero, Horizon3’s autonomous penetration-testing platform. The role combines cloud security research, offensive engineering, and production-quality Python development, with ownership of GCP technical direction and roadmap.
About the company
Horizon3.ai is a technology company specializing in cybersecurity solutions, focusing on automated penetration testing and threat detection for enterprises. They provide a range of services aimed at enhancing security posture and risk management for organizations across various sectors.
The team
NodeZero Attack team; Engineering, Proactive Offense, and Core Attack.
Stack
Google Cloud PlatformPythonGKEKubernetesTerraformgcloudGoogle Cloud APIs
What you'll do
- Research GCP attack paths, identity relationships, misconfigurations, and attacker techniques.
- Build and validate production-quality attacks across GCP services.
- Chain weaknesses into realistic attack paths with reliable proof of exploitability.
- Set technical direction and prioritize GCP attack coverage with Product and Engineering.
- Maintain safe, repeatable attack logic and supporting tests.
- Review designs and code, document research, and mentor engineers.
What we're looking for
- Deep hands-on GCP security and offensive cloud operations experience.
- Expertise in cloud attack paths, IAM permissions, service identities, and resource access.
- Strong Python engineering skills and experience productionizing security research.
- 10+ years of professional software engineering and/or offensive security experience.
- Experience in cloud penetration testing, red teaming, offensive research, or cloud security products.
- Ability to own ambiguous technical work and communicate clearly.
Nice to have
- Cloud privilege-escalation and identity-attack experience.
- Offensive security experience with AWS, Azure, or OCI.
- Experience with GKE, Kubernetes, Terraform, gcloud, Google Cloud APIs, or cloud-native CI/CD.
- Security research, open-source contributions, conference talks, or vulnerability disclosure.
- Experience mapping cloud attack coverage to MITRE ATT&CK for Cloud.
Benefits
- Stock options
- Flexible vacation policy
- Health, vision, and dental insurance for employees and family
- Generous parental leave