Offensive Security Manager

Job Summary

Grade Level (for internal use): 12

• Own and operate the isolated offensive test range and AI-driven codebase-scanning environment to conduct sophisticated attacks against internal systems without impacting production environments
• Execute frontier-grade, AI-enabled offensive security testing using the same advanced capabilities that real-world adversaries employ against crown-jewel systems and critical internal applications
• Map comprehensive attack surfaces and implement TTP (tactics, techniques, procedures) profiles during each test cycle, delivering confirmed exploit paths to defensive teams within established SLAs
• Reproduce and validate real-world threats discovered in the wild, including malicious AI-agent attacks and supply-chain style threats, to verify the effectiveness of existing security controls
• Lead demand-driven security engagements with internal teams, including specialized testing such as agent sandbox-escape scenarios and containment design validation
• Partner closely with defensive security teams in a continuous offensive-to-defensive feedback loop, validating that deployed controls successfully close identified exploit paths through post-remediation testing

Basic Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or equivalent experience in offensive security operations
• 5+ years of hands-on experience in penetration testing, red team operations, or offensive security with demonstrated expertise in advanced attack methodologies
• Proficiency with offensive security frameworks and tools such as Metasploit, Cobalt Strike, or similar platforms, along with custom exploit development capabilities
• Strong programming and scripting skills in languages such as Python, PowerShell, C++, or Go for developing and customizing attack tools and automation
• Experience with AI/ML security testing methodologies and understanding of how artificial intelligence can be leveraged in both offensive and defensive security contexts