Careers in Offensive Security

Stand up a scan environment for an authorized assessment, work the testing checklist, document evidence with screenshots, sit in on a client kickoff call, draft the findings section of a report for a senior to review.

Pick a program from your watchlist, read the latest scope changes, work a feature you have not tested yet, draft a write-up with severity and impact, respond to triage questions on yesterday's submission.

Scope an engagement with the client, execute the test plan, capture evidence, debrief the client on critical findings same-day if needed, write the executive summary and the technical detail sections of the report.

Read source for an authentication flow, build a focused test harness, validate a suspected IDOR, write a technical proof-of-concept for the report, brief the engineering team on the root cause.

Survey a client site, capture authorized traffic, validate guest network segmentation, document signal leakage outside the building, brief facilities on antenna placement findings.

Plan a phishing wave inside the agreed scope, coordinate with the client's blue team on rules of engagement, send the campaign, monitor responses, debrief stakeholders on what worked and what to fix.

Plan a multi-phase simulation against agreed objectives, coordinate operators on a shared timeline, review evidence, brief the blue team on what they detected and missed, write the improvement roadmap.

Work the current phase of an authorized engagement against agreed objectives, log every action for the deliverable, swap tradecraft when the blue team starts catching patterns, contribute to the post-op report.

Reverse a binary you have been hunting in, refine a fuzzer harness, triage a crash, build a working proof-of-concept, draft a disclosure to the affected vendor, mentor a junior researcher.

Review the engagement pipeline, sit in on a senior operator's debrief, approve a methodology update, brief the CISO on systemic findings across the year, mentor a team lead.

Board update on annual threat findings, customer executive briefing, hiring strategy review, regulatory engagement on disclosure norms, methodology direction for the next year.