About the Role :

As a Senior Offensive Security Engineer, you will lead offensive security efforts and own Anaplans vulnerability management programme. This is a dual-scope role: youll drive adversarial testing to find whats broken, and youll run the process that ensures vulnerabilitiesfrom your own assessments, scanners, bug bounty, and third-party audits are tracked, prioritised, and remediated at the right pace. Youll mentor the Offensive Security Engineer and serve as a technical authority across product and platform teams.

Individual Contributor Focus :

- Operates independently on complex offensive engagements and vulnerability management decisions, setting scope and priority without close supervision.

- Communicates risk and remediation trade-offs to cross-functional stakeholders at the project and product-line level, influencing engineering roadmaps where security debt is material.

- Mentors the Offensive Security Engineer and security champions across engineering, but carries no direct people management responsibility.

Responsibilities :

Offensive Security :

- Advanced Penetration Testing & Red Teaming: Lead complex, multi-phase penetration tests and red team exercises against Anaplans platform, cloud infrastructure, and AI-powered products. Define engagement scope, rules of engagement, and success criteria.

- Threat Modelling & Attack Path Analysis: Conduct adversarial threat modelling for new features and architectural changes, identifying realistic attack chains that inform both offensive testing and defensive controls.

- Offensive Tooling & Capability Development: Build and maintain reusable offensive tooling, automation frameworks, and testing methodologies that scale with the platforms evolution.

- Mentorship & Technical Leadership: Guide the Offensive Security Engineer on methodology, scoping, and report quality. Raise the bar on how offensive findings translate into engineering action.

Vulnerability Management :

- Programme Ownership: Own the end-to-end vulnerability management lifecycle: intake from scanners, penetration tests, bug bounty, and third-party audits; triage and risk-rating; assignment to responsible teams; tracking through to verified remediation.

- Prioritisation & Risk Calibration: Apply consistent, risk-based prioritisation that accounts for exploitability, blast radius, data sensitivity, and business contextnot just CVSS scores.

- Metrics & Reporting: Define and maintain vulnerability management metrics (mean time to remediate, ageing, SLA compliance) and report trends to security leadership and engineering stakeholders.

- Process Improvement: Continuously improve the vulnerability management workflow: reduce noise, improve scanner accuracy, tighten integration with CI/CD and ticketing systems, and make it easier for engineering teams to act on findings.

Cross-Cutting :

- Incident Support: Support major security incident investigations with offensive expertisereproducing attack paths, validating exposure scope, and advising on containment.

- Stakeholder Communication: Present findings, risk assessments, and programme health to engineering leads, product managers, and security leadership with clarity and appropriate urgency.

Qualifications:

- Experience: 5+ years in offensive security, penetration testing, or a combination of offensive security and vulnerability management, with increasing scope and independence.

- Offensive Depth: Proven ability to find and exploit non-trivial vulnerabilities in web applications, APIs, cloud infrastructure, or enterprise SaaS platforms. Comfortable building custom exploits and tooling.

- Vulnerability Management: Experience designing or running a vulnerability management programme triage workflows, SLA frameworks, scanner tuning, and remediation tracking at meaningful scale.

- Cloud & Infrastructure: Strong working knowledge of at least one major cloud provider (AWS, GCP, or Azure), including cloud-native attack surfaces, IAM misconfigurations, and container/orchestration security.

- Technical Communication: Able to write penetration test reports that engineers respect, present risk trade-offs to non-security stakeholders, and influence remediation timelines without formal authority.

- Judgement: Demonstrated ability to prioritise across competing risks balancing offensive testing coverage, vulnerability backlog, and engineering capacity without defaulting to everything is critical.

Nice to Have :

- Experience testing AI/ML-powered features or pipelines for security weaknesses.

- Track record of improving vulnerability management metrics (MTTR, SLA adherence, backlog reduction) in a product or platform engineering context.

- Offensive security certifications such as OSCP, OSWE, OSCE, CRTO, or GXPN.

- Contributions to open-source offensive tooling, published vulnerability research, or conference presentations.

- Experience with supply-chain security assessment (dependency analysis, build pipeline integrity, SBOM).