Information Security - Offensive Security - Manager

Role Summary

We are seeking an Offensive Security Manager to lead and execute penetration testing and red team engagements. You will plan and execute authorized security assessments — including web applications, APIs, internal/external networks, cloud environments, and full-scope red team engagements — to identify exploitable weaknesses before real adversaries do. You'll work closely with Sec/Ops, detection engineering, application security, and IT teams to translate findings into measurable risk reduction.

Key Responsibilities

• Plan, scope, and execute penetration tests and red team engagements across web applications, APIs, internal/external networks and cloud infrastructure (AWS/Azure/GCP).
• Lead and mentor a team of Red Team and application Security engineers.
• Support Executive and Leadership Alignment of the application security and red teaming programs with Engineering and Platform teams.
• Define and execute the offensive security strategy, roadmap, and testing methodologies.
• Conduct and oversee adversary emulation exercises, red team operations, penetration testing, and security assessments.
• Evaluate the effectiveness of security controls through realistic attack simulations and threat-informed testing.
• Partner with Security Operations and Detection Engineering teams to drive purple team exercises and improve detection and response capabilities.
• Research emerging threats, attacker techniques, and offensive security trends to continuously improve testing capabilities.
• Simulate real-world adversary tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK, including initial access, privilege escalation, lateral movement, persistence, and exfiltration simulation.
• Perform manual and automated testing of web apps and APIs (REST/GraphQL/SOAP) for OWASP Top 10, business logic flaws, authentication/authorization bypass, and API-specific abuse cases.
• Conduct internal network penetration tests: Active Directory attack paths, Kerberoasting, relay attacks, segmentation testing, and post-exploitation.
• Provide risk-based recommendations and work closely with engineering teams to drive remediation efforts.
• Communicate security findings, risks, and strategic recommendations to technical and executive stakeholders.
• Build and scale offensive security programs, processes, and talent within the organization.

Requirements

• 10+ years of experience in Offensive Security, Red Teaming, Penetration Testing, Security Research, or related cybersecurity disciplines.
• 3+ years of experience leading and developing high-performing security teams.
• Strong expertise in adversary emulation, red teaming, penetration testing, and threat-driven security assessments.
• Hands-on experience with purple teaming, threat hunting, exploit development, or security research.
• Strong scripting skills to build and maintain test automation, reusable checks, and validation scripts (Python, Bash, PowerShell).
• Experience assessing cloud platforms (AWS, Azure, GCP), enterprise environments, and cloud-native technologies including containers and Kubernetes.
• Strong understanding of application security, network security, identity security, and detection engineering concepts.
• Excellent communication skills with the ability to influence and collaborate across technical and business teams.