[All remote jobs](https://jobicy.com/jobs.md)[![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png)](https://jobicy.com/company/liftoff.md)[Liftoff](https://jobicy.com/company/liftoff.md) # Security Engineer, Offensive Security AI Summary Liftoff is hiring a senior Offensive Security Engineer to build and own continuous internal offensive-security testing across applications, APIs, cloud infrastructure, and corporate systems. The role requires independent penetration-test planning, safe exploit validation, source-code review, architectural analysis, and end-to-end remediation verification with engineering teams. The engineer will develop security automation and AI-assisted testing workflows while partnering with Detection & Response on detection improvements and incident-response exercises. This is a hands-on, high-impact security engineering position that includes shared on-call responsibilities and occasional off-hours incident response.[Apply for this job](#job-application)[View company](https://jobicy.com/company/liftoff.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 184k–250k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished9 Nov 2026Apply before9 Dec 2026Listing views51Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. [Liftoff](https://jobicy.com/company/liftoff.md) is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize revenue across programmatic and direct demand. Liftoff’s solutions, including Accelerate, Direct, Monetize, Intelligence, and Vungle Exchange, support over 6,600 mobile businesses across 74 countries in sectors such as gaming, social, finance, ecommerce, and entertainment. Founded in 2012 and headquartered in Redwood City, CA, Liftoff has a diverse, global presence. ### About Liftoff Security Team The Liftoff Security team protects Liftoff’s customers, users, and employees. We architect Liftoff’s security posture, build the tools and systems that defend it, and partner with engineering teams as they ship new products and features. Our work spans the entire stack — infrastructure, web, mobile, and IT — and we approach security from a software engineering standpoint, scaling our impact through automation and well-designed tools. As our Security Engineer, Offensive Security, you will own internal offensive testing and lead the move from point-in-time penetration tests to continuous, AI-assisted testing. You will independently plan assessments, safely validate vulnerabilities, work with engineering teams through remediation and retesting, and build sustained knowledge of our source code and systems. You will contribute across application, cloud, and infrastructure security, support Accelerate and MX as priorities change, and share the team’s on-call and incident-response work. ### Responsibilities * Independently plan and execute internal penetration tests across applications, APIs, cloud infrastructure, and corporate systems; prioritize assessments by risk and business impact. * Define testing scope and rules of engagement with system owners, assess production risk, and choose safe methods for validating vulnerabilities. * Combine hands-on testing with source-code review and architectural analysis to find vulnerabilities and demonstrate realistic attack paths. * Partner with engineering teams to explain findings, agree on practical fixes, track remediation, and retest to confirm the risk is resolved. * Maintain knowledge of Liftoff’s systems and attack surface, revisit high-risk attack paths as systems change, and turn confirmed findings into repeatable tests. * Build testing tools and workflows that combine hands-on assessments with ongoing automated testing and remediation validation. * Make security testing self-service where practical through reusable tests, documented assessment and retesting workflows, and clear remediation guidance. * Support the annual third-party penetration test for independent validation and customer and audit requirements; coordinate scope and follow findings through remediation. * Lead adoption of AI-assisted offensive security tooling: evaluate platforms and build workflows for code analysis, test generation, and finding triage; measure coverage, accuracy, and effort saved. * Partner with Detection & Response to turn validated attack paths and offensive findings into detection improvements and incident-response exercises. * Work across application, cloud, and infrastructure security as priorities change, including Accelerate and MX, and share the team’s on-call and incident-response rotation, including occasional off-hours response and post-incident follow-up. ### Minimum qualifications * 5+ years of relevant security engineering experience, including substantial hands-on penetration testing of applications and infrastructure. * Excellent judgment in prioritizing testing by risk, assessing production impact, and safely validating exploits without unnecessary disruption. * Experience independently owning assessments and partnering with engineering teams from initial findings through remediation and retesting. * Write production-quality code for security tools and automation, review pull requests, and navigate large, unfamiliar codebases. Develop safe proof-of-concept code and independently validate AI-generated code and findings. * Strong understanding of application and API security, authentication and authorization, network security, and common vulnerability classes. * Hands-on experience assessing cloud and infrastructure security, including identity and access controls, configuration, and attack paths. * Ability to quickly understand complex systems and architecture and contribute across application, cloud, and infrastructure security. * Practical software engineering habits: testing, observability, version control, peer code review, continuous integration, and blameless postmortems. * Strong technical writing: clear assessment plans, proposals, reproducible findings, runbooks, and post-incident reviews that support engineering decisions. Explain exploitability and business impact clearly in writing and conversation. * Willingness to share the security team’s on-call and incident-response responsibilities, including occasional off-hours response. ### Desirable qualifications * Experience with Go, Python, Clojure, or JavaScript; ability to work across languages matters more than a specific language. * Experience building AI-assisted security testing workflows and measuring the accuracy and usefulness of their results. * Experience securing large-scale cloud systems, mobile advertising, or other high-volume SaaS environments. ### Why This Role is Exciting * Ownership & Impact: Build and own our in-house offensive security capability, from selecting assessments to confirming fixes. * Broad Attack Surface: Test applications, APIs, cloud infrastructure, and corporate systems with access to source code and engineering context. * Engineering Partnership: Work with teams that value security and stay involved through remediation and retesting. * Room to Grow: Move from point-in-time penetration tests to continuous testing and lead adoption of AI-assisted offensive security tools. Hands-On Technical Work: Investigate complex systems, validate vulnerabilities safely, and build tools that make testing more effective. Compensation: The following are our base salary ranges for this role: * SF Bay Area, Los Angeles/Orange County, NYC, Seattle: $200,000 – $250,000 plus bonus * All other cities and towns in our approved states: $184,000 – $220,000 plus bonus #LI-EL1 We use Covey as part of our hiring and/or promotional process for jobs in NYC and certain features may qualify it as an AEDT. As part of the evaluation process, we provide Covey with job requirements and candidate-submitted applications. We began using [Covey Scout for Inbound](https://getcovey.com/product/covey-scout-inbound) on January 22, 2024. Please see the independent bias audit report covering our use of Covey [here](https://getcovey.com/nyc-local-law-144). Liftoff offers a fast-paced, collaborative, and innovative work environment where employees are empowered to grow and make an impact. We’re shaping the future of the mobile app ecosystem—join us and help accelerate what’s next. Liftoff’s compensation strategy includes competitive salaries, equity, and benefits designed to support employee well-being and performance. We benchmark compensation based on role, level, and location to ensure fairness and market alignment. Benefits may include medical coverage, wellness stipends, and additional perks based on your country of residence. Liftoff is an equal opportunity employer. We are committed to creating an inclusive environment for all employees and applicants regardless of race, ethnicity, national origin, age, marital status, disability, sexual orientation, gender identity, religion, veteran status, or any other characteristic protected by applicable law. Agency and Third Party Recruiter Notice: Liftoff does not accept unsolicited resumes from individual recruiters or third-party recruiting agencies in response to job postings. No fee will be paid to third parties who submit unsolicited candidates directly to our hiring managers or Recruiting Team. All candidates must be submitted via our Applicant Tracking System by approved Liftoff vendors who have been expressly requested to make a submission by our Recruiting Team for a specific job opening. No placement fees will be paid to any firm unless such a request has been made by the Liftoff Recruiting Team and such a candidate was submitted to the Liftoff Recruiting Team via our Applicant Tracking System. Show more [Apply now >](https://jobicy.com/jobs/160030-security-engineer-offensive-security.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe role combines advanced offensive testing with production-risk judgment, secure tool development, cloud and application security, and incident response. It requires independently driving assessments through remediation while influencing multiple engineering teams. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$217,000US market range (per year)$190k–$260k0$286k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses annual base-salary ranges of $184,000–$220,000 for approved states outside specified high-cost markets and $200,000–$250,000 for the SF Bay Area, Los Angeles/Orange County, NYC, and Seattle. The yearly cadence is inferred from the stated base-pay magnitude, US location, and senior full-time security engineering context; bonuses are excluded from base-pay calculations. The combined disclosed midpoint is $217,000 per year. Estimated US market base pay for a senior offensive security engineer is approximately $190,000–$260,000 per year. ## Core skills Skills and capabilities most closely associated with this opportunity. [Penetration Testing](https://jobicy.com/jobs?search_keywords=Penetration%20Testing.md)[Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[API Security](https://jobicy.com/jobs?search_keywords=API%20Security.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[Infrastructure Security](https://jobicy.com/jobs?search_keywords=Infrastructure%20Security.md)[Source Code Review](https://jobicy.com/jobs?search_keywords=Source%20Code%20Review.md)[Vulnerability Management](https://jobicy.com/jobs?search_keywords=Vulnerability%20Management.md)[Security Automation](https://jobicy.com/jobs?search_keywords=Security%20Automation.md)[Threat Modeling](https://jobicy.com/jobs?search_keywords=Threat%20Modeling.md)[Identity and Access Management](https://jobicy.com/jobs?search_keywords=Identity%20and%20Access%20Management.md)[Network Security](https://jobicy.com/jobs?search_keywords=Network%20Security.md)[Incident Response](https://jobicy.com/jobs?search_keywords=Incident%20Response.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Go](https://jobicy.com/jobs?search_keywords=Go.md)[AI Security Testing](https://jobicy.com/jobs?search_keywords=AI%20Security%20Testing.md) Sample interview questionsHow would you prioritize offensive-security assessments across Liftoff's applications, APIs, cloud infrastructure, and corporate systems?I would maintain an inventory of critical assets and rank targets using business impact, data sensitivity, internet exposure, privilege concentration, architectural change, and known threat activity. I would then define a scoped assessment plan with system owners, document safety controls, and revisit high-risk paths as the environment changes. Describe how you safely validate a suspected critical vulnerability in a production environment. I first confirm the scope, obtain stakeholder agreement, and select the least disruptive validation method. I use non-destructive proof-of-concepts, tightly limit requests and access, collect reproducible evidence, stop when risk exceeds the agreed threshold, and coordinate remediation before retesting. What makes a security finding actionable for an engineering team? An actionable finding clearly explains the affected component, preconditions, attack path, technical evidence, business impact, severity rationale, and a practical remediation option. I also provide reproduction steps or a safe test, discuss trade-offs with the owners, and retest the fix to verify that the risk is resolved. How would you introduce AI-assisted offensive-security tooling without relying on inaccurate results? I would begin with constrained use cases such as code-review triage, test-case generation, and finding enrichment. I would measure precision, recall, time saved, and false-positive rates against human-reviewed baselines, require validation of generated findings and code, and only automate actions that have clear safety controls. How do offensive-security findings improve detection and incident response? For validated attack paths, I work with Detection and Response to identify observable behaviors, logging gaps, and useful detection logic. We can turn the scenarios into purple-team exercises, create runbooks, test alert quality, and use post-exercise results to improve both preventive controls and response readiness. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Instacart logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/fe39c2bc9bb5ebb0b5e24318b1f3b60d.jpeg) Instacart Nov 9 New ### [Detection Engineer II](https://jobicy.com/jobs/160025-detection-engineer-ii.md) We’re transforming the grocery industry At Instacart, we invite the world to share love through food because we believe everyone should have access to the food they love and more… * ![DeleteMe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c26c546a-221.png) DeleteMe Nov 9 New ### [Solutions Engineer, Cyber Security](https://jobicy.com/jobs/154932-solutions-engineer-cyber-security.md) About DeleteMe: DeleteMe is the leader in proactive privacy protection. We help security teams reduce their human attack surface by continuously monitoring and removing exposed personal data (PII) from the… * ![Caylent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/9ed8d81b-221.jpg) Caylent Nov 8 New ### [Security Engineer](https://jobicy.com/jobs/159882-security-engineer-5.md) Caylent is an AI-first cloud services company that helps organizations turn ambitious ideas into meaningful business impact. As an AWS Premier Tier Services Partner and a charter member of Anthropic’s… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 8 New ### [Staff Enterprise Security Engineer](https://jobicy.com/jobs/159859-staff-enterprise-security-engineer.md) RDQ227R1176 While candidates in the listed location(s) are encouraged for this role, candidates in other locations (US based) will be considered. Mission Databricks is hiring an L6 Staff Enterprise Security… * ![D2L logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/0ac958a8-221.jpg) D2L Nov 8 New ### [Senior Application Security Analyst](https://jobicy.com/jobs/159850-senior-application-security-analyst.md) D2L is a cloud company that is modernizing education and building the Future of Work. The old models of teaching and learning are in the midst of the largest transformation… * ![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png) 1Password Nov 8 New ### [Senior IT Engineer, Identity and Access Management](https://jobicy.com/jobs/159753-senior-it-engineer-identity-and-access-management.md) 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up… * ![Goodleap logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/482c4fb7-221.png) Goodleap Nov 8 New ### [Staff Security Engineer, Security Operations](https://jobicy.com/jobs/159659-staff-security-engineer-security-operations.md) About GoodLeap: GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more…. * ![Discord logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/02/WRILS-210216185819-522054.jpg) Discord Nov 8 New ### [Engineering Manager, Platform Security](https://jobicy.com/jobs/154856-engineering-manager-platform-security.md) Discord has a highly engaged community of millions of daily active users who use the platform for many different reasons, but there’s one thing that nearly everyone does: play video… * ![HackerOne logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/8937d355-221.png) HackerOne Nov 8 New ### [Senior Security Engineer, Identity and Access Management](https://jobicy.com/jobs/154842-senior-security-engineer-identity-and-access-management.md) HackerOne is a global leader in Continuous Threat Exposure Management (CTEM). The HackerOne Platform unites agentic AI solutions with the ingenuity of the world’s largest community of security researchers to… * ![Elevenlabs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e01b4c5d-221.png) Elevenlabs Nov 8 New ### [Safety Engineer – Free Tier Abuse](https://jobicy.com/jobs/154823-safety-engineer-free-tier-abuse.md) About ElevenLabs ElevenLabs is an AI research and product company transforming how we interact with technology. We launched in January 2023 with the first human-like AI voice model. Today, we… [Browse all jobs](https://jobicy.com/jobs.md)