238K–280K USD / year
Staff Attack Engineer, External
OtherRemote — United States
Published on 2026-10-19
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead development of external attack capabilities for an autonomous penetration-testing platform. Build scalable reconnaissance and data-analysis workflows, model attack paths, and turn offensive research into safe, production-ready automated workflows.
About the company
Horizon3.ai is a technology company specializing in cybersecurity solutions, focusing on automated penetration testing and threat detection for enterprises. They provide a range of services aimed at enhancing security posture and risk management for organizations across various sectors.
The team
Proactive Offense, External Attack
Stack
PythonGraph databases
What you'll do
- Build scalable workflows to discover, enumerate, and fingerprint external-facing assets and services.
- Parse and enrich large volumes of unstructured external data.
- Extend attack-path models to represent identity, privilege, and relationship paths.
- Automate multi-step attack workflows from discovery through post-exploitation.
- Research emerging offensive techniques and deliver them as production attack content.
- Set the external attack coverage roadmap and mentor attack engineers.
What we're looking for
- 10+ years of hands-on offensive security, security research, or security-focused software engineering experience.
- Deep external attack experience spanning reconnaissance, initial access, and post-exploitation.
- Experience building scalable reconnaissance systems and automating end-to-end attack workflows.
- Strong Python and production software engineering skills.
- Experience analyzing unstructured data and connecting high-volume data as relationships.
- Knowledge of identity-focused tradecraft, including credential attacks, SSO, and federation.
Nice to have
- OSCP, OSEP, CRTO, or equivalent certification.
- Experience with certificate transparency, passive DNS, or internet-wide scanning.
- Experience with Entra ID, Okta, AWS, cloud and SaaS identity surfaces, or external-to-internal pivots.
- Experience with graph databases, attack-path analysis, or high-volume data processing.
- Public contributions such as open-source tools, technical writing, conference talks, or CVEs.
Benefits
- Stock options
- Flexible vacation policy
- Parental leave
- Health, vision, and dental insurance