{"id":3897709,"url":"https://alion.io/job/group-1001-senior-offensive-security-engineer","title":"Senior Offensive Security Engineer","company":{"id":1854086,"name":"Group 1001","domain":"group1001.com","url":"https://alion.io/company/group1001","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":94,"open_postings":4,"ghost_share":0,"stale_share":0.25,"repost_share":0,"time_to_fill_p50_days":36,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":200000,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":200000},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"Red Teaming","optional":false},{"name":"Burp Suite","optional":true},{"name":"C++","optional":true},{"name":"Cobalt Strike","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Rust","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-11-06T23:37:25Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-07T04:50:58Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Group 1001 is a consumer-centric, technology-driven family of insurance companies on a mission to deliver outstanding value and operational performance by combining financial strength and stability with deep insurance expertise and a can-do culture. Group1001’s culture emphasizes the importance of collaboration, communication, core business focus, risk management, and striving for outcomes. This goal extends to how we hire and onboard our most valuable assets - our employees.\nWhy This Role Matters:\nGroup 1001 is seeking a hands-on Senior Offensive Security Engineer to lead penetration testing and red team operations across our cloud, endpoint, application, and API environments. You will be the technical owner of our offensive testing program: planning and performing penetration tests, running red and purple team exercises, managing our private bug bounty program, and reducing our external attack surface.\nAs our application security and SDLC practices mature, you will also embed with development teams, align testing to their release cycles, and help move security testing earlier in the lifecycle. This role reports to the AVP of Security Lifecycle & Architecture and works closely with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit. If additional headcount is approved, you will provide technical direction and mentorship to a second offensive security engineer.\nHow You'll Contribute:\nPlan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, endpoints, internal web and desktop applications, and APIs, with clear, prioritized remediation guidance.\nPartner with development teams to learn their release schedules, plug testing into their delivery cycles, and help mature application security and SDLC practices.\nLead and perform quarterly red team and purple team operations that simulate real-world adversary tactics to test detection, response, and overall resilience.\nManage the private bug bounty program, including strategy, scope, vulnerability triage, severity validation, and coordination of remediation with internal teams.\nOperate the enterprise continuous attack surface monitoring platform, triage external findings, and drive remediation to closure.\nOversee third-party testing vendors, including the annual external penetration test: define scope and objectives, review deliverables, and ensure results align with internal priorities and regulatory expectations.\nValidate remediation through retesting and track findings to closure with application, infrastructure, and security owners.\nTranslate offensive findings into defensive improvements by working with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit.\nDevelop and refine offensive tooling, techniques, and processes to improve the effectiveness and efficiency of the program.\nTrack and report program metrics, risk reduction, and security posture improvements, and present results to technical teams and senior leadership.\nProvide technical leadership, coaching, and work direction to additional offensive security team members as the team grows.\nWhat We're Looking For:\n8+ years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles.\nDemonstrated experience performing penetration tests against cloud environments (Azure, AWS, and/or GCP), endpoints, web and desktop/native applications, and APIs.\nExperience conducting full-scope red team operations and purple team exercises.\nStrong background in vulnerability triage, risk prioritization, and guiding remediation with development, infrastructure, and security teams.\nExperience managing or significantly contributing to a bug bounty program.\nFamiliarity with continuous attack surface management platforms and external exposure reduction.\nSolid understanding of adversary tactics, techniques, and procedures (TTPs) and modern detection and response capabilities.\nExcellent written and verbal communication skills, including the ability to present findings and risk to executives and non-technical stakeholders.\nPreferred Qualifications:\nExperience developing custom tooling, exploits, implants, payloads, or evasion techniques.\nHands-on experience with commercial and open-source offensive tooling (for example Cobalt Strike, custom C2 frameworks, Burp Suite) and the ability to build or modify tools as needed.\nProgramming or scripting proficiency (Python, PowerShell, C/C++, Rust, etc.) sufficient for custom tooling or exploit development.\nRelevant certifications such as OSCP, OSWE, OSCE, GXPN, or equivalent demonstrated expertise.\nExperience working with or managing third-party penetration testing vendors.\nExperience working with development teams on secure SDLC, DevSecOps, or secure code review.\nKnowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives.\nPrior experience in financial services, insurance, or other regulated environments (for example NYDFS 23 NYCRR 500).\nPrior experience mentoring or leading other security engineers.\nWhat Success Looks Like:\nYou are the primary owner of offensive security outcomes for Group 1001: delivering a steady, well-scoped penetration testing cadence, running a continuous testing program that reduces real-world risk and improves detection and response, and maintaining a high-quality bug bounty and attack surface management function. Development teams see you as a partner rather than a gate, and leadership gets clear, metrics-driven reporting on risk reduction.\nCompensation:\nOur compensation reflects the cost of labor across several U.S. geographic markets. The base pay for this position ranges from $200,000/year in our lowest geographic market up to $270,000/year plus bonus in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience.\nBenefits Highlights:\nEmployees who meet benefit eligibility guidelines and work 30 hours or more weekly, have the ability to enroll in Group 1001’s benefits package. Employees (and their families) are eligible to participate in the Company’s comprehensive health, dental, and vision insurance plan options. Employees are also eligible for Basic and Supplemental Life Insurance, Short and Long-Term Disability. All employees (regardless of hours worked) have immediate access to the Company’s Employee Assistance Program and wellness programs-no enrollment is required.Employees may also participate in the Company’s 401K plan, with matching contributions by the Company.\nGroup 1001, and its affiliated companies, is strongly committed to providing a supportive work environment where employee differences are valued. Diversity is an essential ingredient in making Group 1001 a welcoming place to work and is fundamental in building a high-performance team. Diversity embodies all the differences that make us unique individuals. All employees share the responsibility for maintaining a workplace culture of dignity, respect, understanding and appreciation of individual and group differences.\n#LI-AS1 #LI-REMOTE","description_format":"text","description_chars":7136,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Life insurance","Vision insurance","Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Property & Casualty Insurance","Life Insurance & Annuities"],"lifecycle":[{"event":"open","at":"2026-11-06T23:37:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":36,"reasons":["conf:24","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":200000,"is_top_pay":true},"html_url":"https://alion.io/job/group-1001-senior-offensive-security-engineer","json_url":"https://alion.io/job/group-1001-senior-offensive-security-engineer.json","meta":{"generated_at":"2026-11-08T12:48:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27244,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1854086},"rest":"https://alion.io/mcp/rest/get_company?id=1854086"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgroup-1001-senior-offensive-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgroup-1001-senior-offensive-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgroup-1001-senior-offensive-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/group-1001-senior-offensive-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgroup-1001-senior-offensive-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3897709}},{"tool":"search_jobs","arguments":{"company":"group1001.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3897709},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}