We're seeking an experienced Offensive Security Engineer to join our growing security team with a focus on offensive security, threat research, and exploit development. You will identify vulnerabilities, understand how they function behind the scenes, and develop patterns and tools to mitigate risks. If you have a strong technical background, are passionate about offensive security, and enjoy working in decentralized environments, we want to hear from you.
Key Responsibilities:
Red Team Strategy & Execution
- Lead and design sophisticated Red Team operations targeting Internet Computer Protocol, governance, subnets, nodes, and system dApps
- Develop adversary emulation plans to test both platform and infrastructure defenses, identifying weaknesses before they can be exploited
Exploit Development & Vulnerability Research
- Research, develop, and test advanced exploits against the Internet Computer Protocol and infrastructure
- Maintain an internal repository of exploits, scripts, and tools for advanced offensive security operations
Infrastructure Security
- Strengthen the security of Internet Computer Operating Systems (ICOS) running on virtual machines by implementing advanced hardening measures
- Perform vulnerability assessments and penetration tests on the ICOS environment and the overall Internet Computer infrastructure to identify and mitigate risks
- Harden and assess security for internal Kubernetes clusters and associated services, ensuring robust defense mechanisms against container-based attacks
- Perform security testing across cloud-native infrastructures, CI/CD pipelines, and microservices environments, identifying lateral movement paths and privilege escalation risks
Tool Development & Automation
- Build and maintain custom offensive security tools for exploit delivery, post-exploitation automation, and Red Team simulations
- Develop secure operational tools to streamline complex engagements and support security monitoring, threat detection, and incident handling
Collaboration & Incident Handling
- Partner with cross-functional teams, including blockchain developers, DevOps, and infrastructure engineers, to embed security best practices throughout the development lifecycle
- Lead incident response efforts involving blockchain or internal systems, conducting thorough post-mortems and implementing mitigation strategies
- Publish security advisories and report CVEs
Requirements:
- Extensive experience planning and executing Red Team engagements in complex, distributed environments, simulating advanced persistent threats (APTs) across blockchain and traditional infrastructure
- Skilled in adversary emulation, lateral movement techniques, privilege escalation, and exfiltration tactics
- Proven experience in identifying and exploiting vulnerabilities specific to blockchain ecosystems, including distributed consensus mechanisms, smart contract execution, and inter-node communication
- Strong understanding of kernel-level vulnerabilities, hypervisor security, and virtualized environments
- Strong understanding of SELinux
- Expertise in securing Kubernetes clusters and traditional infrastructure, with a focus on container security.
- Proficiency in working with QEMU virtualization technologies and AMD SEV-SNP secure enclaves is a plus
- This is a hybrid-onsite position, based out of our soon-to-be-opened office in the heart of San Francisco.
Base Salary Range: $175,000 - $240,000/yr
This position can be considered across multiple levels. Total compensation at DFINITY consists of base salary + generous bonus and is determined based on multiple factors including job leveling, areas of expertise, educational background, geographic location and overall experience.
In addition to the cash components of our offers, we have generous benefits including top tier medical, dental, and vision insurance; disability insurance; life insurance; 401(k); flexible PTO policy in addition to paid holidays.
About DFINITY and the Internet Computer:
