Senior Security Engineer (Offensive & Application Security)

We are seeking a highly skilled and versatile Security Engineer to join our team. This role demands a professional who can confidently lead offensive security engagements such as network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and large language model (LLM) systems. Beyond offensive tasks, the role requires building and managing security controls, writing policies, and ensuring compliance audits are met. You will work across Plutus21 and its clients, balancing hands-on red-team activities with governance and operational responsibilities, setting the foundation for a growing security function.

Key Responsibilities

- Conduct comprehensive penetration tests on networks, applications, APIs, and cloud environments following recognized methodologies (e.g., PTES), including scoping, execution, and retesting phases.
- Lead red-team and adversary simulation exercises aligned with the MITRE ATT&CK framework, focusing on realistic attack paths rather than isolated vulnerabilities.
- Perform social engineering and phishing assessments when authorized.
- Deliver detailed findings with proof-of-concept, business impact analysis, severity ratings (CVSS), and actionable remediation guidance.
- Exploit and report on the full OWASP Top 10 vulnerabilities in web and PHP applications, including Laravel, WordPress, and legacy custom stacks.
- Conduct deep PHP application testing involving source-assisted review, object injection, deserialization chains, file upload abuses, and CMS/plugin weaknesses.
- Test REST and GraphQL APIs and single-page front ends against current attack vectors.
- Red-team AI and LLM systems against the OWASP LLM Top 10, including prompt injection, jailbreaks, data exfiltration, insecure tool usage, and denial-of-service risks.
- Evaluate agent and retrieval-augmented generation (RAG) systems for security weaknesses and translate findings into engineering guardrails and test cases.
- Integrate secure development practices into CI/CD pipelines through threat modeling, secure code review, and security testing (SAST, DAST, dependency and secret scanning).
- Design, deploy, and maintain security controls across cloud platforms (AWS preferred), corporate infrastructure, endpoints, and identity management.
- Manage identity and access with least-privilege principles, multi-factor authentication, and periodic access reviews.
- Implement and operate cloud security posture management tools.
- Monitor threats and vulnerabilities, triage alerts, and lead incident detection, response, and post-incident reviews.
- Select, deploy, and manage security tooling including SIEM, EDR, vulnerability scanners, and CSPM.
- Develop and maintain security policies, standards, and procedures aligned with recognized frameworks.
- Drive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.
- Assess vendor and client security postures, providing clear and prioritized remediation recommendations.
- Communicate risks, incidents, and metrics effectively to leadership and clients, translating technical risks into understandable language.
- Deliver security awareness training to internal teams.
- Define the structure, roadmap, and hiring plan for the expanding security team.
- Within the first 90 days, conduct an internal penetration test of Plutus21’s cloud and applications, establish core security tooling, complete an external client engagement, and publish initial security policies and SOC 2 control mappings.

Required Qualifications

- Minimum five years of hands-on cybersecurity experience with a strong focus on offensive security, including penetration testing or red teaming as a core responsibility.
- Proven expertise in web application testing, especially with PHP-heavy stacks such as Laravel, WordPress, or legacy custom code.
- Deep understanding of the OWASP Top 10 and modern web/API attack techniques, with demonstrated ability to produce working exploits.
- Familiarity with AI and LLM attack surfaces including prompt injection, jailbreaks, and agent/RAG abuse, or the capacity to learn quickly.
- Strong working knowledge of at least one major cloud platform (AWS preferred) and its native security services.
- Practical experience in incident response, threat detection, and log analysis using SIEM and EDR tools.
- Solid foundation in networking, operating systems, identity management, and encryption.
- Proficiency in scripting and automation using Python, Bash, or PowerShell.
- Experience with compliance frameworks such as SOC 2, ISO 27001, or NIST CSF.
- Self-directed and able to prioritize effectively under pressure, comfortable being the sole security expert initially.
- Excellent written and verbal communication skills, capable of translating technical risks into clear, non-technical language.

Preferred Qualifications and Benefits

- Offensive security certifications such as OSCP (strongly preferred), OSWE, OSEP, or CRTP.
- Broader security credentials including CISSP, CEH, CompTIA Security+, or recognized cloud security certifications.
- Publicly verifiable achievements such as bug bounty results, CVEs, published research, or a portfolio of tools and write-ups.
- Fluency with Burp Suite Professional and experience developing custom tooling or extensions.
- Hands-on experience with AI red-teaming against production LLM or agent systems.
- Exposure to multiple cloud platforms and experience in consulting or multi-client delivery environments.

This role offers the opportunity to lead and shape a security function from the ground up, working on cutting-edge offensive and defensive security challenges across diverse environments.