Senior Offensive Security Engineer

Title: Senior Offensive Security Engineer
Location: Remote
Terms: Full-time
Salary: $175-185k DOE
Clearance: Ability to obtain and maintain public trust as required

Project Description

This position supports cybersecurity operations and offensive security testing efforts for the Department of Veterans Affairs (VA). The role focuses on conducting time based penetration testing activities that support the Authority to Operate (ATO) process for system owners across enterprise environments.

The environment includes modern web applications, APIs, cloud infrastructure, operating systems, databases, and network devices across both on-premises and cloud hosted systems.

The core challenge: proactively identifying vulnerabilities and security weaknesses before adversaries can exploit them while supporting mission critical healthcare and federal systems and raising the bar of the offensive security team that performs this work.

Position Description

As a Senior Offensive Security Engineer at Revolutional, you will serve as a technical subject matter expert on an Offensive Security Team; driving the quality, depth, and consistency of penetration testing, web, and Red Team operations support across enterprise systems, applications, cloud infrastructure, and networks.

Beyond executing the most complex assessments yourself, you will help lead the team executing the assessments and aid in providing technical guidance, engagement with government leaders, review findings, mentoring junior and mid-level operators, and elevating the team's tradecraft. You will be expected to be able to conduct assessments and solve hard technical problems end to end, support development of custom tooling and automation (including AI assisted capabilities), and ensure the team efficiently executes and reports offensive engagements.  

This role is for a seasoned offensive operator who can think like the adversary, discovery security vulnerabilities that are more than the results of some automated scanning tool, experience using OPSEC minded on target operations as part of a red team campaign and deliver technically accurate reports and articulate the results to leaders that can help improve the security posture of federal systems.  

Responsibilities: 

• Serves as a senior leader on an offensive security team providing technical expertise across penetration testing, web application testing, and Red Team operations, ensuring a high standard for depth and quality of testing occurs
• Help lead the offensive security team: planning and resourcing engagements, reviewing peer findings, and providing hands on technical mentorship to junior and mid-level penetration testers
• perform time based penetration tests against web applications, APIs, databases, network devices, operating systems, cloud environments, and infrastructure
• Perform advanced manual web application testing against modern frameworks and APIs, going well beyond OWASP Top 10 to identify complex, business logic, and chained vulnerabilities
• Lead and support advanced Red Team operations, including threat modeling, initial access, command and control (C2), post exploitation, lateral movement, and EDR evasion
• Design and build custom tools, scripts, exploits, and automation to expand and mature the Offensive Security Team's capabilities
• Integrate AI assisted tooling and automation into penetration testing and application security workflows to increase speed, coverage, and consistency
• Review newly published vulnerabilities and develop impact assessments and detection/exploitation guidance for customer environments
• Analyze vulnerabilities and determine associated risk based on exploitability and operational impact
• Author clear, concise, and actionable reports; present findings, metrics, and remediation recommendations to customers, system owners, and executive stakeholders
• Define and evolve testing methodologies, operational procedures, and reporting standards for the team
• Maintain offensive security infrastructure, hardware, and software used for assessments and attack simulations
• Support assessments that may require work outside standard business hour

Technical Environment

Operating Systems

• Kali Linux Suite
• Windows, Unix, and Linux

Offensive Security Tooling

• Burp Suite Professional, Nessus (Tenable), NMAP, Metasploit
• Command and control (C2) frameworks (e.g., Cobalt Strike or equivalent) and Active Directory attack tooling (e.g., BloodHound)
• Nuclei, Project discovery tools

Cloud & Web Application

• Cloud security assessment across AWS, Azure, and/or GCP; modern web frameworks and API testing

Scripting, Automation & Development

• Bash, PowerShell, and Python; additional development languages (e.g., Go, C#, C/C++) a plus
• AI/LLM assisted tooling and security automation frameworks

Security Practices

• Penetration Testing
• Web Application Testing
• Vulnerability Analysis
• Threat Modeling
• Red Team Operations
• Security Reporting
• Tool Development

What You Bring (Requirements):

• Baseline Requirements:
  • Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field (5 years of additional relevant experience may substitute for education)
  • 6+ years of overall experience in cybersecurity or IT, with 5+ years dedicated to offensive security or penetration testing
  • Demonstrated experience leading engagements and mentoring or developing other testers
  • At least one industry recognized offensive security certification (e.g., OSCP or higher)
  • Ability to obtain and maintain required federal clearance / public trust as needed
• Technical Capabilities:
  • Proven, hands on experience conducting penetration tests using industry standard offensive security tools across Windows, Unix, and Linux
  • Deep expertise in identifying, validating, and exploiting web application vulnerabilities, including complex and business logic flaws
  • Experience assessing cloud infrastructure and internal networks, including Active Directory attack paths
  • Experience developing custom tools, scripts, or exploits to enhance offensive security operations
  • Experience with Red Team TTPs, including C2, post exploitation, and EDR evasion
  • Strong scripting and automation skills in Bash, PowerShell, Python, or similar languages
  • Experience applying AI assisted tools or automation to penetration testing and vulnerability analysis
  • Ability to communicate technical findings clearly through written reports and customer/executive briefings
• Core Strengths: 
  • Strong analytical and problem solving skills with an adversarial mindset
  • Technical leadership: the ability to set direction, review others' work, and raise the team's tradecraft
  • Strong ownership mindset and accountability for outcomes
  • Effective written and verbal communication skills
  • Ability to operate in fast paced and mission focused environments
  • Strong collaboration and teamwork skills
• Nice to Have (Differentiators): 
  • Web application specialization: GIAC Web Application Penetration Tester (GWAPT)
  • Advanced offensive certifications such as OSCE³ (OSEP + OSWE + OSED), OSEP, OSWE, or OSED
  • Red Team leadership: Certified Red Team Operator (CRTO / CRTO II) or equivalent
  • Experience applying AI/LLM assisted tooling, automation frameworks, or scripted solutions to enhance penetration testing and vulnerability analysis
  • Experience with advanced Red Team operations including reverse engineering, malware development, C2, and EDR evasion
  • Experience supporting federal government cybersecurity programs