Senior Security Engineer (Offensive & Application Security)

We are seeking a highly skilled and versatile Security Engineer to join our team, trusted to deliver across a wide range of engagements. This role primarily focuses on offensive security, including network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and large language model (LLM) systems. Beyond offensive tasks, you will establish and manage the security function from the ground up—building controls, writing policies, and ensuring audit readiness. You will work across Plutus21 and its clients, balancing hands-on red-team exercises with governance and compliance responsibilities. This is a unique opportunity to set foundations, develop tooling and processes, and contribute to building a growing security team.

Key Responsibilities

- Conduct comprehensive penetration tests on networks, applications, APIs, and cloud environments using recognized methodologies such as PTES, covering all phases from scoping to retesting.
- Execute red-team and adversary simulation exercises aligned with the MITRE ATT&CK framework, focusing on realistic attack paths rather than isolated vulnerabilities.
- Perform social engineering and phishing assessments when authorized.
- Deliver detailed findings with proof-of-concept exploits, business impact analysis, CVSS severity ratings, and actionable remediation guidance.
- Exploit and report on the full OWASP Top 10 vulnerabilities, with deep expertise in PHP application testing (including Laravel, WordPress, and legacy custom stacks), source-assisted code review, and common CMS/plugin weaknesses.
- Test APIs (REST and GraphQL) and single-page applications against current attack vectors.
- Red-team AI and LLM systems against the OWASP LLM Top 10, addressing prompt injection, jailbreaks, data exfiltration, insecure tool use, supply-chain risks, and denial-of-service scenarios.
- Translate AI security findings into practical guardrails and test cases for engineering teams.
- Integrate secure development practices into the CI/CD pipeline, including threat modeling, secure code review, and security testing (SAST, DAST, dependency, and secret scanning).
- Design, deploy, and maintain security controls across cloud platforms (AWS preferred), corporate infrastructure, endpoints, and identity management systems.
- Manage identity and access with least-privilege principles, multi-factor authentication, and periodic access reviews.
- Implement and operate cloud security posture management tools.
- Lead security operations including threat monitoring, alert triage, incident detection, response, and post-incident reviews.
- Select, deploy, and manage security tooling such as SIEM, EDR, vulnerability scanners, and CSPM.
- Develop and maintain security policies, standards, and procedures aligned with recognized frameworks.
- Drive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.
- Assess vendor and client security postures, providing clear and prioritized remediation recommendations.
- Communicate risks, incidents, and metrics effectively to leadership and client stakeholders, translating technical risk into understandable language.
- Deliver security awareness training to internal teams.
- Define the structure, roadmap, and hiring plan for the expanding security team.
- Within the first 90 days, perform an internal penetration test of Plutus21’s cloud and key applications, establish core security tooling, complete an external client engagement, and publish initial security policies and SOC 2 control documentation.

Required Qualifications

- Minimum of five years of hands-on cybersecurity experience with a strong focus on offensive security (penetration testing or red teaming as a core responsibility).
- Proven expertise in web application testing, particularly PHP-heavy environments such as Laravel, WordPress, or legacy custom code.
- Deep understanding of the OWASP Top 10 and modern web/API attack techniques, with the ability to demonstrate working exploits.
- Knowledge of AI and LLM attack surfaces, including prompt injection and jailbreaks, or the aptitude to learn quickly.
- Strong experience with at least one major cloud platform (AWS preferred) and its native security tools.
- Practical skills in incident response, threat detection, and log analysis using SIEM and EDR solutions.
- Solid foundation in networking, operating systems, identity management, and encryption.
- Proficiency in scripting and automation using Python, Bash, or PowerShell.
- Familiarity with compliance frameworks such as SOC 2, ISO 27001, or NIST CSF.
- Self-directed and capable of prioritizing under pressure, comfortable being the sole security expert initially.
- Excellent written and verbal communication skills, able to translate complex technical risks into clear language for non-technical audiences.

Preferred Qualifications and Benefits

- Offensive security certifications such as OSCP (strongly preferred), OSWE, OSEP, or CRTP.
- Broader credentials including CISSP, CEH, CompTIA Security+, or recognized cloud security certifications.
- Publicly verifiable achievements like bug bounty results, CVEs, published research, or a portfolio of tools and write-ups.
- Fluency with Burp Suite Professional and experience developing custom tooling or extensions.
- Hands-on experience with AI red-teaming against production LLM or agent systems.
- Exposure to multiple cloud platforms and experience in consulting or multi-client delivery environments.

This role offers the chance to lead and shape security practices in a dynamic environment, working on cutting-edge offensive and defensive challenges while building a security function from the ground up.