Offensive Security Engineer

Foresite is looking for a dedicated Offensive Security Engineer to manage and scale our proactive security services built on the Horizon3.ai NodeZero platform. In this role, you will lead the deployment, orchestration, and continuous analysis of autonomous penetration testing across a multi-tenant client base.

This role is designed for a strategic technical professional who excels at bridging the gap between traditional offensive testing and managed defense, turning raw exploit data into actionable remediation roadmaps and verifying fix actions for our clients to help them reduce risk before attackers exploit them.

What You'll Do:

In this role, you will operate at the intersection of Foresite’s managed security expertise and Horizon3.ai’s autonomous testing technology. You will partner closely with our internal Blue Teams, SOC Analysts, and client IT leaders to identify vulnerabilities, map attack paths, and validate remediations. You will be measured on the successful management of client environments, the clarity of your remediation strategies, and measurable security posture improvements across our multi-tenant client base.

Platform Management & Orchestration

• Platform Management: Configure, deploy, and manage the Horizon3.ai NodeZero platform across diverse multi-tenant client environments, covering internal, external, cloud, and hybrid infrastructures.

• Testing Execution: Schedule and execute continuous or on-demand autonomous penetration tests based on client risk profiles, compliance mandates, or zero-day threats.

• Asset & License Registry: Manage licensing, concurrent testing allocations, and IP address allotments across the client tracking registry.

Analysis & Security Validation

• Exploit Analysis: Analyze complex NodeZero testing outputs to differentiate between theoretical vulnerabilities and actual, exploitable attack vectors.

• Attack Path Mapping: Map active attack paths and context-poisoning vectors to help defensive teams isolate systemic security weaknesses.

• Post-Remediation Verification: Conduct post-remediation security validation testing to scientifically verify that security patches or configuration changes successfully closed the exploit path.

Reporting & Client Advisory

• Strategic Advisory: Translate highly technical attack data into clear, risk-prioritized remediation strategies for client IT and security leaders.

• Quarterly Business Reviews: Conduct strategic Quarterly Business Reviews (QBRs) to visually demonstrate client security posture improvements and measurable security outcomes over time.

• Compliance Deliverables: Produce compliance-ready penetration testing artifacts satisfying requirements for frameworks such as SOC 2, HIPAA, PCI-DSS, and ISO 27001.

Cross-Functional SOC Integration

• Defensive Tuning: Partner closely with internal Blue Teams and SOC Analysts to tune SIEM, EDR, and XDR alerting rules based on insights gained from NodeZero attack loops.

• Threat Modeling: Support threat modeling initiatives by analyzing automated attack chains and translating them into defensive playbooks.

Who You Are:

• Experienced Pro: You have 3–5 years of experience in cybersecurity, with at least 2 years working within an MSSP, SOC, or offensive security consulting team.

• Offensive Security Savvy: You have a deep understanding of penetration testing methodologies, the MITRE ATT&CK framework, and common network/cloud lateral movement techniques.

• Technical Navigator: You possess a strong grasp of enterprise networking (VLANs, firewalls, routing) and hybrid cloud architectures (AWS, Azure, GCP).

• Collaborative Communicator: You have an exceptional ability to explain complex technical vulnerabilities and exploit chains to non-technical executive stakeholders.

• Education: Bachelor’s degree or equivalent practical experience.

Nice to Have:

• Platform Expertise: Proven hands-on experience with Horizon3.ai NodeZero (certification or accreditation under the Horizon3.ai Vanguard Partner Prog