SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 238,000 - 280,000 / annual
Horizon3.ai is a fast-growing remote cybersecurity company building NodeZero, an autonomous pentesting platform that helps organizations proactively discover and verify exploitable attack vectors before criminals exploit them. The platform is used by ITOps/SecOps teams, consulting pentesters, and MSSPs/MSPs across organizations of all sizes, from educational institutions to Global 100 enterprises.
You will be a Staff Attack Engineer and technical leader for external attack capabilities in NodeZero. This is a highly strategic role focused on turning the manual reconnaissance and multi-step attack work that skilled operators perform by hand into safe, reliable, repeatable workflows that run autonomously against large external attack surfaces.
Key responsibilities include:
- Design, build, and maintain highly scalable reconnaissance workflows in production-grade Python that discover, enumerate, and fingerprint external-facing assets and services.
- Research and parse large volumes of external-facing data from unstructured and inconsistent sources, turning it into accurate, actionable information.
- Develop robust approaches to difficult data types (banners, web content, documents, error output) and build parsing and enrichment that works across diverse real environments.
- Collect, store, and connect high volumes of information; extend attack-path modeling and graph data models to represent new identity, privilege, and relationship paths.
- Traverse identity relationships across the external surface (accounts, tenants, SSO, federation, exposed credentials, third-party services) to find compromise paths.
- Automate multi-step attack workflows that chain discovery, credential access, initial access, and post-exploitation into complete, safely proven attack paths.
- Research emerging external tradecraft and turn it into production attack content, emphasizing techniques that succeed against hardened, well-monitored targets.
- Stand up and maintain representative test environments to validate, demonstrate, and regression-test attack scenarios.
- Build for production safety and scale, respecting target and customer environments, rate limits, and scope.
- Set priorities and coverage roadmap based on real customer environments, threat intelligence, and emerging techniques.
- Mentor and level up attack engineers; raise the bar on code quality, research rigor, and operational safety.
- Collaborate cross-functionally with engineers, product managers, and customer-facing teams; author internal documentation and external research.
Requirements:
- 10+ years of hands-on experience in offensive security, security research, or security-focused software engineering, with recent work building and shipping offensive tooling.
- Deep, hands-on offensive experience against external attack surfaces, from reconnaissance through initial access and post-exploitation.
- Demonstrated experience building reconnaissance and discovery systems that run at scale, not just one-off scripts.
- Strong skill at researching and parsing large amounts of messy, unstructured external data and turning it into usable, trustworthy information.
- Experience collecting, storing, and connecting high volumes of data and reasoning about it as relationships (identities, assets, trust).
- Command of identity-focused tradecraft: credential access, password and token attacks, SSO and federation weaknesses, moving among identities, tenants, and services.
- Experience automating multi-step attack workflows end to end.
- Strong software engineering fundamentals with Python and a track record of shipping and maintaining production-quality code, not just scripts and proofs of concept.
- Ability to independently research unfamiliar systems and technologies and rapidly become the team's expert.
- Strong written and verbal communication, including clear technical documentation.
- Passion for building products, not just finding vulnerabilities.
Preferred qualifications:
- OSCP, OSEP, CRTO, or equivalent offensive certifications.
- Experience with large-scale internet data sources and tooling (certificate transparency, passive DNS, internet-wide scanning).
- Experience with cloud, SaaS, and hybrid identity attack surfaces (Entra ID, Okta, AWS, similar), including on-prem to cloud pivots.
- Experience with external to internal pivoting and how perimeter footholds lead into additional access.
- Experience with graph databases, attack-path analysis, datalake or high-volume data storage and processing.
- Experience developing or contributing to offensive or recon tooling.
- Public contributions to the field: open-source tools, technical blog posts, conference talks, or published CVEs.
- Experience building production-safe autonomous or automated offensive tooling.
The role is fully remote with up to 5% travel required. Horizon3 offers competitive salary, equity (stock options), health/vision/dental insurance, flexible vacation, and generous parental leave.
