Principal Offensive Security

Frame the problem space: identify which offensive security risks matter most to the business, and set the technical strategy, frameworks, and priorities that guide how multiple teams address them.

Shape the multi-year technical roadmap for penetration testing, red teaming, AI security validation, and vulnerability research.

Define the standards, methodologies, and metrics that make offensive security work measurable and tied to risk reduction.

Anticipate downstream impact, such as emerging attack techniques, architectural shifts, and AI adoption, and bring it into planning before it becomes an incident.

Personally lead the most complex and ambiguous engagements across web, API, mobile, cloud, container, and AI-enabled systems.

Design and guide red team operations, adversary simulations, and purple team exercises.

Set technical direction and quality bars for external penetration testing partners and vendors, and review their findings and methodology.

Evolve attack surface management and continuous security validation into a repeatable, scalable capability.

Define the organization's approach to AI red teaming for LLM-enabled products and agentic workflows, including threat models, test methodologies, and risk criteria.

Work with AI and engineering teams to build security into the AI development lifecycle through architecture and design reviews.

Create scalable, reusable approaches to AI security testing, validation, and risk assessment that other teams can adopt.

Set the technical direction for vulnerability triage, prioritization, remediation, and retesting, with risk-based practices adopted across engineering.

Resolve the hardest triage and severity decisions where the right answer isn't clear.

Evolve the bug bounty and vulnerability disclosure programs, including scope, policy, and researcher engagement.

Build formal and informal networks across Engineering, Product, Security Operations, Compliance, and Legal to align groups on security priorities.

Translate technical findings into business risk and present trends and recommendations to senior leadership.

Mentor and coach security engineers, set the technical standard for the team, and informally guide those who run day-to-day testing.

Help shape the future of AI-enabled offensive security across the organization.

12+ years of related Information Security experience with a Bachelor's degree, including 8+ years in Offensive Security and 4+ years in Development or Engineering.

A track record as a recognized expert whom others seek out guidance, with demonstrated impact on offensive security programs in SaaS and cloud environments.

Deep, hands-on expertise in penetration testing, red teaming, vulnerability research, vulnerability management, and security testing of AI-enabled products.

Strong command of application security, cloud security, attack surface management, and secure development practices.

Experience with modern cloud environments, APIs, web applications, containers, and AI/LLM technologies.

Proven ability to work through ambiguous, cross-functional problems with high autonomy, and to define the approach rather than follow one.

Ability to translate technical findings into business risk and influence stakeholders at all levels, including executives.

Experience coaching and raising the technical capability of others without formal management authority.

Relevant certifications such as OSCP, OSWE, GXPN, GPEN, CISSP, CCSP, or cloud security certifications are considered an asset.

Assess the current offensive security landscape and identify the highest-impact problems, not just the most visible ones.

Build trusted relationships across engineering, security, and business teams.

Define the technical roadmap and priorities for continuous security validation.

Establish scalable AI-enabled offensive security methods and standards that other teams adopt.

Improve vulnerability management effectiveness and remediation outcomes through clearer prioritization and risk-based practices.

Raise the technical bar of the security team through coaching, reviews, and shared frameworks.

Guide the scaling of autonomous vulnerability management across critical assets and environments.

Mature AI-enabled red team capabilities and continuous, threat-informed security validation.

Demonstrate measurable reductions in organizational risk through AI-enabled offensive security capabilities.

For this role, the estimated annual base salary range is between $138,200.00 - $200,000.00 (CAD). In addition to base salary, our compensation package may include bonuses, commissions for eligible sales roles, and a comprehensive benefits package. The actual base salary will vary based on factors including individual qualifications and market data, as objectively assessed during the interview process.

This posting is for a new vacancy.

This hiring process utilizes artificial intelligence tools to assist in candidate screening and assessment. Our AI tools are designed to complement — not replace — human decision-making.