Lead Offensive Security Engineer

Job Title: Lead Offensive Security Engineer

About the role:

Veracity is looking for a highly skilled Offensive Security Engineer to join our growing cybersecurity team. This role is integral to executing sophisticated offensive security operations, including red teaming, penetration testing, and tailored cybersecurity exercises. As an Offensive Security Engineer, you will lead assessments that mimic real-world adversarial tactics, techniques, and procedures to identify vulnerabilities, improve defensive strategies, and strengthen our security posture.

This position is remote but may require onsite presence occasionally to Atlantic City, NJ.

Key Responsibilities:

• Plan, design, and execute red team engagements, including adversary emulation, to assess the resilience of systems and processes.
• Perform manual penetration testing on web applications, infrastructure, cloud services, and API’s utilizing creative and unconventional approaches to discover vulnerabilities.
• Develop custom attack vectors and exploit vulnerabilities manually, emphasizing stealth and persistence to emulate real adversary behavior.
• Lead cybersecurity exercises and create targeted attack scenarios to test response effectiveness.
• Assess and prioritize risks based on manual testing outcomes, providing actionable remediation recommendations.
• Collaborate with blue teams and stakeholders to refine detection, response, and prevention strategies.
• Document technical findings in clear, concise reports and communicate results to both technical and non-technical audiences.
• Continuously stay updated on the latest threats, vulnerabilities, and offensive security techniques.
• Implement and maintain red team and penetration testing tools, ensuring they are effective, up-to-date, and properly configured for engagements.

Qualifications:

• 10+ years of experience in cyber security, with at least 4 years in red teaming or adversary emulation required.

1. 5 years of experience may replace a Bachelor's degree.
2. A Master’s or MBA may replace a Bachelor's degree and 3 years of experience.
3. A PhD may replace a Bachelor's degree and 7 years of experience.

• At least one of the following offensive security certifications such as OSCP, OSCE, OSEP, OSWE, CRTO, CRTP, GPEN, GXPN, or BSCP.

Required Skills:

• Proven ability to emulate adversary tactics, techniques, and procedures (TTPs) without relying heavily on automated tools.
• Strong experience in manual penetration testing, focusing on identifying business logic flaws, misconfigurations, and complex vulnerabilities.
• Proficiency in using manual exploitation techniques to identify and leverage privilege escalation paths, lateral movement opportunities, and persistence mechanisms.
• Solid understanding of internal network penetration techniques, Active Directory attacks, and techniques for evading defenses.
• Understanding of Windows, Linux, and cloud infrastructure (e.g., AWS, Azure) from an attacker perspective.
• Experience working in collaborative offensive-defensive engagements to improve detection and response.
• Excellent technical writing and communication skills, with the ability to clearly present findings and articulate complex vulnerabilities.
• Understanding of operational security (OPSEC) and evasion strategies to mimic advanced persistent threats.
• Hold or be eligible to obtain a security clearance of SECRET or higher.
• Demonstrated ability to lead, manage, and mentor staff.
• Familiarity with threat frameworks such as MITRE ATT&CK and proficiency in mapping TTPs to scenarios.

Preferred Skills:

• Ability to develop custom exploits or modify existing ones to evade detection and achieve engagement goals.
• Experience implementing C2 frameworks such as Cobalt Strike.
• Advanced scripting knowledge (e.g., Python, PowerShell, Bash) for developing custom tools and payloads.
• Experience with DevOps and CI/CD technologies.
• Experience testing AI/ML systems, including LLMs.
• Working knowledge of NIST, OMB, DOT, or FAA security requirements.