Senior Security Engineer (Offensive & Application Security)

We are seeking a highly skilled Security Engineer who can confidently lead and deliver across a wide range of security engagements. This role primarily focuses on offensive security, including network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and large language model (LLM) systems. However, as a one-person security team, you will also establish defensive measures, develop security controls, write policies, and ensure audit readiness. You will work across Plutus21 and its clients, balancing hands-on red-team exercises with governance tasks such as SOC 2 documentation. You will set foundational security practices, build tooling and processes, and contribute to growing the security team as demand increases.

Key Responsibilities

Offensive Security:
- Conduct comprehensive penetration tests on networks, applications, APIs, and cloud environments using recognized methodologies (e.g., PTES).
- Lead red-team and adversary simulation exercises aligned with MITRE ATT&CK, focusing on realistic attack paths rather than isolated vulnerabilities.
- Perform social engineering and phishing assessments when authorized.
- Deliver detailed findings with proof-of-concept, business impact, severity ratings (CVSS), and actionable remediation.

Web and PHP Application Attacks:
- Exploit and report vulnerabilities across the OWASP Top 10, including injection flaws, broken access control, authentication weaknesses, SSRF, and insecure deserialization.
- Perform deep PHP application testing on Laravel, WordPress, and legacy custom stacks, including source-assisted review and exploitation of common CMS/plugin weaknesses.
- Test REST and GraphQL APIs and single-page applications against current attack vectors.

AI and LLM Attacks:
- Red-team AI and LLM systems against the OWASP LLM Top 10, covering prompt injection, jailbreaks, data exfiltration, insecure tool use, and denial of service risks.
- Test client AI systems, including agent and retrieval-augmented generation (RAG) platforms, for tool abuse and data isolation failures.
- Translate findings into engineering guardrails and test cases.

Application Security in CI/CD Pipelines:
- Integrate secure development practices such as threat modeling, secure code review, and security testing (SAST, DAST, dependency and secret scanning) into CI/CD workflows.

Cloud, Infrastructure, and Identity:
- Design, deploy, and maintain security controls across cloud platforms (AWS preferred), corporate infrastructure, endpoints, and identity management.
- Enforce least-privilege access with MFA and periodic reviews.
- Implement and manage cloud security posture management (CSPM).

Security Operations and Incident Response:
- Monitor threats and vulnerabilities, triage alerts, and lead detection, response, and post-incident reviews.
- Select, deploy, and operate security tools such as SIEM, EDR, vulnerability scanners, and CSPM.

Governance, Risk, and Compliance:
- Develop and maintain security policies, standards, and procedures aligned with recognized frameworks.
- Drive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.
- Assess vendor and client security postures, providing clear, prioritized remediation recommendations.

Client Delivery and Team Building:
- Communicate risks, incidents, and metrics clearly to leadership and clients, translating technical risk into plain language.
- Deliver security awareness training to internal teams.
- Define the security team’s structure, roadmap, and hiring plan as the function expands.

Required Qualifications

- Minimum five years of hands-on cybersecurity experience with a strong offensive security focus (penetration testing or red-teaming as a core responsibility).
- Proven expertise in web application testing, especially PHP-heavy stacks such as Laravel, WordPress, or legacy custom code.
- Deep understanding of the OWASP Top 10 and modern web/API attack techniques, with demonstrated working exploits.
- Familiarity with AI and LLM attack surfaces, including prompt injection and jailbreaks, or the ability to learn quickly.
- Strong knowledge of at least one major cloud platform (AWS preferred) and its native security tools.
- Practical experience in incident response, threat detection, and log analysis using SIEM and EDR.
- Solid foundation in networking, operating systems, identity management, and encryption.
- Proficiency in scripting and automation (Python, Bash, or PowerShell).
- Experience with compliance frameworks such as SOC 2, ISO 27001, or NIST CSF.
- Self-motivated and able to independently manage a security function from the ground up.
- Excellent written and verbal communication skills, capable of translating technical risks for non-technical audiences.

Preferred Qualifications and Benefits

- Offensive security certifications such as OSCP (strongly preferred), OSWE, OSEP, or CRTP.
- Broader credentials like CISSP, CEH, CompTIA Security+, or recognized cloud security certifications.
- Publicly recognized contributions such as bug bounty achievements, CVEs, published research, or security tool development.
- Fluency with Burp Suite Professional and experience developing custom tooling or extensions.
- Hands-on experience with AI red-teaming against production LLM or agent systems.
- Exposure to multiple cloud platforms and experience in consulting or multi-client environments.

This role offers a unique opportunity to lead security efforts across offensive, defensive, and governance domains while shaping the future security team. If you thrive in a dynamic environment and enjoy owning end-to-end security functions, this position is an excellent fit.