Cybersecurity Engineer

We are seeking a highly skilled Security Engineer who can confidently lead diverse security engagements with a strong offensive focus, including network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and large language model (LLM) systems. This role also encompasses defensive and governance responsibilities, requiring the ability to establish security functions from the ground up. As a one-person security team, you will not only identify vulnerabilities but also build controls, develop policies, and ensure compliance through audits.

You will work across Plutus21 and its clients, balancing offensive security tasks such as red-team exercises with defensive duties like documenting SOC 2 evidence. This role demands deep expertise in offensive security alongside competence in broader security disciplines. You will lay the foundation for security tooling and processes, and as demand grows, contribute to hiring and expanding the security team.

Key Responsibilities

- Lead comprehensive penetration tests on networks, applications, APIs, and cloud environments using recognized methodologies (e.g., PTES), managing the full lifecycle from scoping to retesting.
- Conduct red-team and adversary simulation exercises aligned with the MITRE ATT&CK framework, focusing on realistic attack paths rather than isolated vulnerabilities.
- Perform social engineering and phishing assessments when authorized.
- Deliver detailed findings including proof-of-concept exploits, business impact analysis, severity ratings (CVSS), and actionable remediation guidance.
- Exploit and report on the full OWASP Top 10 vulnerabilities, with a focus on PHP-heavy stacks such as Laravel, WordPress, and legacy custom applications.
- Conduct deep hands-on testing of APIs (REST and GraphQL) and single-page applications against current attack vectors.
- Red-team AI and LLM systems against the OWASP LLM Top 10, addressing prompt injection, jailbreaks, data exfiltration, insecure tool use, supply-chain risks, and denial-of-service scenarios.
- Translate AI security findings into practical guardrails and test cases for engineering teams.
- Integrate secure development practices into CI/CD pipelines, including threat modeling, secure code review, and security testing (SAST, DAST, dependency and secret scanning).
- Design, deploy, and maintain security controls across cloud platforms (AWS preferred), corporate infrastructure, endpoints, and identity management systems.
- Manage identity and access controls following least-privilege principles, enforce MFA, and conduct regular access reviews.
- Establish and operate cloud security posture management tools.
- Monitor threats and vulnerabilities, triage alerts, and lead incident detection, response, and post-incident reviews.
- Select, deploy, and manage security tooling such as SIEM, EDR, vulnerability scanners, and CSPM.
- Develop and maintain security policies, standards, and procedures aligned with recognized frameworks.
- Drive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.
- Assess vendor and client security postures and provide clear, prioritized remediation recommendations.
- Communicate risks, incidents, and security metrics effectively to leadership and clients, translating technical risks into accessible language.
- Deliver security awareness training to internal teams.
- Define the security team’s structure, roadmap, and hiring plans as the function scales.

Required Qualifications

- Minimum five years of hands-on cybersecurity experience with a strong focus on offensive security, including penetration testing or red-teaming as a core responsibility.
- Proven expertise in web application testing, particularly with PHP-based stacks such as Laravel, WordPress, or legacy custom code.
- Deep understanding of the OWASP Top 10 and modern web/API attack vectors, with demonstrated ability to produce working exploits beyond automated scanner outputs.
- Working knowledge of AI and LLM attack surfaces, including prompt injection, jailbreaks, and agent or retrieval-augmented generation (RAG) system abuse, or the ability to learn quickly.
- Strong experience with at least one major cloud platform (AWS preferred) and its native security services.
- Practical skills in incident response, threat detection, and log analysis using SIEM and EDR tools.
- Solid foundation in networking, operating systems, identity management, and encryption.
- Proficiency in scripting and automation using Python, Bash, or PowerShell.
- Experience with compliance frameworks such as SOC 2, ISO 27001, or NIST CSF.
- Self-directed with the ability to prioritize effectively under pressure and operate independently as the sole security resource.
- Excellent written and verbal communication skills, capable of translating technical risks into clear, non-technical language.

Preferred Qualifications and Benefits

- Offensive security certifications such as OSCP (highly preferred), OSWE, OSEP, or CRTP.
- Broader certifications including CISSP, CEH, CompTIA Security+, or recognized cloud security credentials.
- A public track record demonstrating contributions to security research, bug bounty programs, CVEs, or published tools and write-ups.
- Proficiency with Burp Suite Professional and experience developing custom tooling or extensions.
- Hands-on experience with AI red-teaming against production LLM or agent systems.
- Exposure to multiple cloud environments and experience in consulting or multi-client delivery settings.

This role offers a unique opportunity to own and shape the security function within a dynamic environment, balancing offensive expertise with strategic defensive responsibilities.