Role overview
We're seeking an experienced Offensive Security Engineer to join our growing security team with a focus on offensive security, threat research, and exploit development. You will identify vulnerabilities, understand how they function behind the scenes, and develop patterns and tools to mitigate risks. If you have a strong technical background, are passionate about offensive security, and enjoy working in decentralized environments, we want to hear from you.
What you'll work on
Red Team Strategy & Execution
- Lead and design sophisticated Red Team operations targeting Internet Computer Protocol, governance, subnets, nodes, and system dApps
- Develop adversary emulation plans to test both platform and infrastructure defenses, identifying weaknesses before they can be exploited
Exploit Development & Vulnerability Research
- Research, develop, and test advanced exploits against the Internet Computer Protocol and infrastructure
- Maintain an internal repository of exploits, scripts, and tools for advanced offensive security operations
What we're looking for
- Partner with cross-functional teams, including blockchain developers, DevOps, and infrastructure engineers, to embed security best practices throughout the development lifecycle
- Lead incident response efforts involving blockchain or internal systems, conducting thorough post-mortems and implementing mitigation strategies
- Publish security advisories and report CVEs
- Extensive experience planning and executing Red Team engagements in complex, distributed environments, simulating advanced persistent threats (APTs) across blockchain and traditional infrastructure
- Skilled in adversary emulation, lateral movement techniques, privilege escalation, and exfiltration tactics
- Proven experience in identifying and exploiting vulnerabilities specific to blockchain ecosystems, including distributed consensus mechanisms, smart contract execution, and inter-node communication
- Strong understanding of kernel-level vulnerabilities, hypervisor security, and virtualized environments
- Strong understanding of SELinux
- Expertise in securing Kubernetes clusters and traditional infrastructure, with a focus on container security.
- Proficiency in working with QEMU virtualization technologies and AMD SEV-SNP secure enclaves is a plus
- This is a hybrid-onsite position, based out of our soon-to-be-opened office in the heart of San Francisco.
Base Salary Range: $175,000 - $240,000/yr
This position can be considered across multiple levels. Total compensation at DFINITY consists of base salary + generous bonus and is determined based on multiple factors including job leveling, areas of expertise, educational background, geographic location and overall experience.
In addition to the cash components of our offers, we have generous benefits including top tier medical, dental, and vision insurance; disability insurance; life insurance; 401(k); flexible PTO policy in addition to paid holidays.