Senior Offensive Security Engineer

About the Team + Role

The Red Team’s mission is to identify and reduce real-world security risks across Robinhood by simulating adversary behavior and testing defenses. As an Offensive Security Engineer, you will plan and execute security assessments across applications, infrastructure, and physical environments, and partner closely with engineering and security teams to strengthen detection and response capabilities. You will help prioritize risk, contribute to remediation efforts, and develop tools and techniques that improve how we test and secure our systems.

This role is based in our Bellevue, WA, New York, NY, Denver, CO, or Menlo Park, CA offices, with in-person attendance expected at least 3 days per week.

What You’ll Do

• Evangelize the Offensive Security Team’s findings and projects with stakeholders throughout the company and collaborate with teams to create solutions balancing security and other priorities.
• Mentor and provide guidance to members of the Offensive Security team.
• Plan and execute red team exercises, including long-term assessments simulating real-world attack scenarios.
• Perform threat modeling and penetration testing across applications, infrastructure, and corporate environments.
• Develop scripts and tools to support and automate security testing activities.
• Partner with detection and response teams to run adversarial simulations and improve incident readiness.
• Communicate findings clearly and work with engineering teams to remediate identified risks.
• Lead security incidents when pentest or Red Team findings require them.
• Plan and participate in adversarial simulation exercises with various security teams.

What You Bring

• 6+ years of experience conducting red team operations or advanced penetration testing.
• Experience mentoring or supporting the development of other security engineers.
• Passion and demonstrated experience for challenging security assumptions.
• Excellent written and verbal communication skills with the ability to communicate findings across different levels of abstraction from Engineers to Executives.
• Passion for fixing security issues and not just identifying them.
• Familiarity with common network protocols and standards such as DNS and TCP/IP.
• Experience with macOS and Linux.
• Experience leveraging components of a modern software development stack to attack companies (including CI, container orchestration systems like Kubernetes/Docker, cloud providers like AWS/GCP) and providing hardening suggestions.
• Experience and knowledge of defensive tools/techniques (IDS/IPS, Packet Capture, Network Analysis, AV, EDR, etc.) and evasion strategies.
• Deep understanding of the MITRE ATT&CK framework.
• Strong understanding of security fundamentals in access and identity.
• Comfortable reading and writing Python, Go, and JavaScript.
• Ability to research and execute a testing plan to assess a new technology or process.
• Demonstrated experience working with a distributed team.
• Proficiency communicating over text-based mediums (Slack, Jira, GitHub, Email) and documenting technical details succinctly.

Bonus Points

• Experience in the Financial Technology (FinTech) domain.
• Experience serving as a technical lead at other organizations.