Senior Red Team Operator, Applications

Job Description:

• Run full kill chains against web, mobile, API, and thick/thin client applications
• Turn candidate findings into working exploits with clear evidence and distinguish real risk from noise
• Map the blast radius from application compromise through identity, cloud, and data
• Review source code for control-flow flaws, injection paths, and insecure design using AI-assisted analysis
• Perform static and dynamic analysis, binary reversing, runtime instrumentation, and API testing
• Translate tradecraft into techniques, decision logic, and evaluation data for AI agents
• Pressure-test AI swarm attack paths and identify naive or incorrect behavior
• Write scripts, tools, and plugins to extend offensive capabilities
• Deliver attack reports and debriefs for engineers, executives, and counsel
• Research emerging vulnerability classes, exploitation techniques, and AI-driven attacker tradecraft
• Balance concurrent operations and internal research with startup-level autonomy

Requirements:

• Deep, hands-on application offense: web app and API exploitation beyond the OWASP Top 10, including business logic abuse, authentication and authorization bypass, and injection chains
• Depth in at least one additional attack surface: mobile, thick/thin clients, source code review, or reverse engineering
• Fluency with Burp Suite, Caido, ZAP, Frida, jadx, Ghidra, and IDA Pro
• Strong grasp of network protocols, client-server architecture, and application vulnerability classes
• Proficiency across Linux, Windows, and macOS
• Scripting in Bash, Python, or similar
• Experience using AI tools for recon, analysis, or tooling
• Ability to make time-sensitive human-in-the-loop judgments and explain reasoning to safety and engineering teams
• Self-directed, scrappy, and comfortable with ambiguity
• Ability to communicate complex attack chains to engineers, executives, and legal counsel
• Must be eligible to work in the United States without sponsorship
• Ability to travel up to 20% for on-site engagements or client meetings
• Offensive automation or AI/ML experience is an advantage
• Offensive tooling experience is an advantage
• Bug bounty findings, CVEs, CTF wins, or application-security conference talks are an advantage
• Active use of PortSwigger Web Security Academy, Hack The Box, or TryHackMe is an advantage
• Relevant certifications such as OSWE, Burp Suite Certified Practitioner, GWAPT, CWES, eWPTX, eMAPT, or TCM Practical Web and Mobile Pentest tracks are an advantage

Benefits:

• Full Health, Dental, & Vision Coverage
• Meaningful Equity Ownership
• In-Office Meals
• Haircuts at the Office
• Company Sponsored Conferences & Events
• 401(k), HSA, and FSA Plans
• Flexible PTO