{"id":2914505,"url":"https://alion.io/job/deriv-senior-offensive-security-engineer-2","title":"Senior Offensive Security Engineer","company":{"id":1778315,"name":"Deriv","domain":"deriv.com","url":"https://alion.io/company/deriv","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Zoho Recruit","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cyberjaya, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19500,"max_usd":44000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Cobalt Strike","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Function Calling","optional":false},{"name":"GCP","optional":false},{"name":"Kubernetes","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Rust","optional":false}],"status":"live","first_seen_at":"2026-07-15T00:00:00Z","employer_posted_date":"2026-07-15","last_verified_at":"2026-10-21T21:39:06Z","board_verified":true,"closed_at":null,"days_open":98,"trust":{"level":"ghost","repost_count":0,"flags":["stale","company_stale"],"days_open":98},"description":"We're not hiring a security engineer to keep up with threats. We're hiring someone to make threats irrelevant before they become incidents.\nWe're looking for a Red Team Lead/Operator who thinks like an adversary, not an auditor. Someone who continuously emulates real-world attackers, challenges assumptions, and exposes the gaps that automated defenses miss. You'll lead offensive security operations across our infrastructure, applications, cloud, and people - turning every engagement into detections, automation, and resilience. The goal isn't to prove we can be breached. It's to make the platform smarter with every attack.\nWhy This Matters\nDeriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders across the globe, around the clock, across regulatory environments. At this scale, a misconfigured WAF rule or undetected lateral movement isn't a technical inconvenience - it's a trader's funds at risk and a regulator on the phone.\nOur Security Operations team isn't defending a perimeter. We're protecting a living, distributed system that processes transactions 24/7. When the threat surface never sleeps, your detection and response capabilities can't either - which is exactly why we're embedding AI and automation at every layer of the security stack.\nThe Challenge\n$600B moves through this platform every month. That kind of scale attracts real adversaries: state-sponsored crews, financially motivated groups, insiders. Not hypothetical threat models, actual ones, actively working against us.\nThat's the environment. Not a lab. Not a CTF. A live financial platform under real pressure, defended by a security org that runs its own incident response instead of reading about breaches in the news.\nWe need someone who can operate like the people already trying to get in. Full kill chain, no shortcuts, no \"we found SQLi and called it a day\" energy.\nIf your idea of a challenging week is a scoped web app pentest with a checklist, this isn't for you. If you want to run against cloud, identity, source code, and now AI agents with tool access and memory, keep reading.\nWhy Deriv\nWe already run our own incident response and purple-team our findings straight into detections, not a compliance exercise, an active discipline with real fallout when it's wrong. Our security org is starting to red-team AI agents with tool access and memory, work most companies haven't figured out how to even scope yet. You'll get hands-on production experience that would take far longer to accumulate at a single-product company.\nWe share what we learn. Deriv is where we write about what we're building, what breaks, and what we figure out the hard way.\nWhat You’ll Do\nPlan and execute full-kill-chain red team engagements: initial access, privilege escalation, lateral movement, persistence, and objective completion, mapped to MITRE ATT&CK\nDesign and run social engineering and physical/insider threat simulations, informed by real-world TTPs\nAttack cloud environments, Kubernetes, and CI/CD pipelines, identifying misconfigurations and privilege escalation paths before real attackers do\nConduct source code analysis and application-layer exploitation against trading, payments, and internal platforms\nRed-team our AI agent stack: prompt injection, tool-calling abuse, agent-to-agent trust boundaries, and credential exposure in agentic workflows\nBuild and maintain custom tooling, C2 infrastructure, and payloads that evade modern detection stacks\nWrite engagement reports and executive summaries that lead to actual remediation, not shelf-ware\nPartner with SOC and Threat Hunting to run purple-team exercises, closing detection gaps you exploited\nMentor L1/L2 operators and contribute to the offensive security capability roadmap\nWho You Are\n6+ years doing actual offensive security. Full-scope red team, not a string of scoped pentests\nOSCP required. OSCE, OSEP, OSED, CRTO or equivalent adversary simulation cert gets you a real look\nReal depth in at least three of: internal AD/network exploitation, cloud attack paths (AWS/GCP), web/API exploitation, custom C2 development, social engineering/physical, mobile\nYou can write your own tooling and implants in Python, Go, or Rust. Not just running Cobalt Strike out of the box\nYou've operated against modern EDR-instrumented environments and know what it actually takes to not get caught\nYou understand blast radius in a regulated fintech and know how to break things without breaking the business\nYou can write a report that gets fixed, not filed\nThe Honest Reality\nYou'll sit inside a Security & AI Engineering org that treats offensive security as a real discipline, not a line item for the compliance audit.\nYou'll work across Dubai and Malaysia with a team that runs actual incident response, not tabletop exercises with fake scenarios.\nYou'll have a direct line from finding a hole to it getting closed, and room to build the tooling and run the engagements that shape how we red-team the AI agents everyone else is still figuring out how to even think about.","description_format":"text","description_chars":5037,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Online Brokerage & Trading Platforms","Forex & CFD Brokers"],"lifecycle":[{"event":"open","at":"2026-10-20T10:25:49Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.391,"p_room":0.28,"age_days":98,"expected_fill_days":37,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/deriv-senior-offensive-security-engineer-2","json_url":"https://alion.io/job/deriv-senior-offensive-security-engineer-2.json","meta":{"generated_at":"2026-10-21T23:06:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32850,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1778315},"rest":"https://alion.io/mcp/rest/get_company?id=1778315"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fderiv-senior-offensive-security-engineer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fderiv-senior-offensive-security-engineer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fderiv-senior-offensive-security-engineer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/deriv-senior-offensive-security-engineer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fderiv-senior-offensive-security-engineer-2"}]}