{"id":102473,"url":"https://alion.io/job/humana-senior-engineer-offensive-security-2","title":"Senior Engineer, Offensive Security","company":{"id":2742,"name":"Humana","domain":"humana.com","url":"https://alion.io/company/humana","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":98,"open_postings":81,"ghost_share":0.025,"stale_share":0.111,"repost_share":0.21,"time_to_fill_p50_days":10,"computed_at":"2026-10-20T05:45:00Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":117600,"max":161700,"currency":"USD","period":"year","gross":null,"usd_annual":161700},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DLP","optional":false},{"name":"GCP","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Multi-Agent Systems","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Red Teaming","optional":false},{"name":"Vertex AI Agent Builder","optional":false},{"name":"Cobalt Strike","optional":true},{"name":"HIPAA","optional":true},{"name":"Human-in-the-Loop","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"Model Context Protocol","optional":true},{"name":"Mythic","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"Reinforcement Learning","optional":true},{"name":"Sliver","optional":true}],"status":"live","first_seen_at":"2026-08-11T00:00:00Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-10-18T16:53:04Z","board_verified":true,"closed_at":null,"days_open":70,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":70},"description":"Become a part of our caring community\nWe're building a new AI & Offensive Tooling capability inside our Offensive Security organization, and we're looking for a senior engineer who can both build it and use it. As Senior Offensive Security Engineer, AI-Driven Red Team & Tooling, you'll build the AI and agentic tooling that makes our offensive operations faster and broader, then prove it where it counts, on real penetration tests, purple-team exercises, and red-team operations.You'll also bring that same offensive lens to the enterprise's own AI systems.\nIt's one loop: build the tooling, prove it on live engagements, feed what you learn back into the tooling. And it's a rare chance to do that hands-on inside a program that helps protect the health data of millions of people.\nWhat you'll do\nOne integrated mission, four ways it shows up:\nBuild agentic offensive tooling. Write production-quality software and AI agents. These agents include LLM-driven planning loops and multi-agent orchestration. Additionally, create tool and function-calling capabilities that drive real offensive tooling. Furthermore, contribute to the in-house agent platform, which powers our pentest and red-team operations. You'll operate this as a production, event-driven cloud platform at real scale (dozens of serverless functions, change-stream data pipelines, hundreds of operational alarms, integrated LLM inference), real software engineering, not proof-of-concept scripting.\nRun penetration tests. Network, web-application, cloud, and infrastructure testing, recon through exploitation, privilege escalation, and lateral movement, accelerated by the tooling you build, with your own judgment owning scope and exploitability.\nRun purple-team exercises. Validate security countermeasures (EDR/XDR, NDR, DLP, firewalls) with our defensive partners, then pair with detection engineering to close the gaps your attacks reveal.\nRun red-team operations and test the enterprise's own AI. Objective-driven adversary emulation; and adversarial assessment of internal LLM-powered products, agents, RAG pipelines, and ML applications, prompt injection, jailbreaks, model extraction and inversion, membership inference, data and supply-chain poisoning, evasion, and agent tool/sandbox abuse, validating that guardrails and classifiers actually hold.\nYour first 6-12 months\n First 90 days: ramp on the agent platform and the offensive service lines; deliver your first engagements (a penetration test and a purple-team exercise) and ship one improvement to the agentic tooling that you used during them.\nBy 6 months: ship at least one AI-driven tool that a service line adopts into its live workflow, with metrics showing coverage or turnaround gains; run a red-team operation end to end.\nBy 12 months: stand up repeatable adversarial testing for at least one of the enterprise's own AI systems; establish an evaluation approach that tracks your tooling's autonomous success against representative targets; become a go-to for both building and operating across the team.\nWhy this role, and why here\n Build and operate (both, for real). Most offensive roles let you build or operate. This one is explicitly both: you ship the software and you run the engagements, so your tooling is shaped by someone who actually uses it.\nA program that's already serious about AI. Fridays are dedicated to R&D. You'll have Hack The Box Pro Labs, all HTB role-based paths and certifications, discretionary certification funding, and conference/training budgets. You'll work alongside the Lead of our new AI & Offensive Tooling capability-contributing to the platform they own while running your own engagements.\nMission that matters. Offensive Security identifies weaknesses so the business can fix them before adversaries exploit them, protecting the data and care of millions of people. AI is entering both our adversaries' tradecraft and our own operations faster than traditional tooling keeps up; you help keep us ahead.\nUse your skills to make an impact\nWhat we're looking for\nWe're hiring for a genuinely hybrid skill set, real offensive operations and real AI engineering. You do not need to check every box below. We expect depth in one half and real credibility plus a desire to grow in the other, not day-one mastery of both. If you're a strong offensive operator who has built real AI tooling, or a strong AI/agent builder with serious hands-on offensive experience, we want to hear from you.\nRequired Qualifications:\nOffensive operations experience: 4+ years in roles such as Red Team, Penetration Testing, Purple Team / control validation, or Bug Bounty, with a track record of delivering engagements end to end: scoping, execution, and clear written findings.\nProduction Python engineering: you build and operate real tooling, not only one-off scripts.\n You've built with agentic AI: hands-on designing, building, or operating AI agents or LLM applications: agentic workflows, tool/function-calling, and orchestration. (We care about what you've shipped and operated, not years on a particular framework-these frameworks are only a few years old.)\nYou've attacked AI: hands-on testing of AI/ML systems: prompt injection, jailbreaking, and adversarial techniques.\n Cloud fluency: production experience with at least one major Cloud Service Provider (AWS, GCP, or Azure).\nPreferred Qualifications:\nBuilt autonomous or semi-autonomous offensive agents, LLM-driven penetration-testing agents, or reinforcement-learning exploit and attack-path planners.\nRed-team tradecraft: C2 frameworks (e.g. Cobalt Strike, Sliver, Mythic), evasion and OPSEC, and testing endpoints protected by modern EDR/XDR.\nPurple-team and adversary-emulation fluency: MITRE ATT&CK, and platforms such as VECTR or Atomic Red Team.\nHands-on with AI red-teaming frameworks such as PyRIT or Garak, and fluent in MITRE ATLAS, the OWASP Top 10 for LLM Applications, and the NIST AI Risk Management Framework.\nModel Context Protocol (MCP), building clients/servers, or testing them and RAG pipelines for tool/prompt-injection abuse.\nCloud penetration-testing depth or multi-cloud breadth; threat-intelligence-driven operations; depth in an advanced offensive specialty (malware development, advanced red-team operations, or adversarial ML research).\nPublished research, open-source contributions, or talks at DEF CON (incl. the AI Village / Generative Red Team), BSides, x33fcon, or Black Hat, or strong showings in AI-security competitions like HackAPrompt.\nCertifications are a plus, not a gate, offensive (e.g. OSCP, OSEP, OSED, OSCE3, CRTO, CRTL, CPTS, CWES, CWEE, CAPE) and emerging AI-security (e.g. the OffSec AI Red Teamer (OSAI / AI-300), the SANS/GIAC AI security line, the HTB AI Red Teamer path).\nHow you'll work\nYou'll work with considerable autonomy on moderately complex engagements and influence the team's technical direction through your expertise. You'll embed with each service line and the AI & Tooling Lead rather than build in isolation; ship software with engineering rigor (reproducibility, evaluation, safety guardrails, human-in-the-loop where offensive operations demand it); deliver findings and tooling with reproduction steps, severity, business impact, and remediation; track risk in the enterprise risk platform; and operate within the organization's acceptable-use-of-AI policies and offensive security rules of engagement.\nWork at Home Requirements: To ensure Home or Hybrid Home/Office employees’ ability to work effectively, the self-provided internet service of Home or Hybrid Home/Office employees must meet the following criteria: At minimum, a download speed of 25 Mbps and an upload speed of 10 Mbps is required; wireless, wired cable or DSL connection is suggested. In certain roles, the minimum recommended internet speed required by Humana may not be sufficient for business needs. Humana reserves the right to require associates to upgrade their internet service if necessary. Work from a dedicated space lacking ongoing interruptions to protect member PHI / HIPAA information.Travel: While this is a remote position, occasional travel to Humana's offices for training or meetings may be required.Scheduled Weekly Hours\n40Pay Range\nThe compensation range below reflects a good faith estimate of starting base pay for full time (40 hours per week) employment at the time of posting. The pay range may be higher or lower based on geographic location and individual pay will vary based on demonstrated job related skills, knowledge, experience, education, certifications, etc.$117,600 - $161,700 per yearThis job is eligible for a bonus incentive plan. This incentive opportunity is based upon company and/or individual performance.Description of Benefits\nHumana, Inc. and its affiliated subsidiaries (collectively, “Humana”) offers competitive benefits that support whole-person well-being. Associate benefits are designed to encourage personal wellness and smart healthcare decisions for you and your family while also knowing your life extends outside of work. Among our benefits, Humana provides medical, dental and vision benefits, 401(k) retirement savings plan, time off (including paid time off, company and personal holidays, paid parental and caregiver leave), short-term and long-term disability, life insurance and many other opportunities.Application Deadline: 10-13-2026About us\nAbout Humana: Humana Inc. (NYSE: HUM) is a leading U.S. healthcare company. Through our Humana insurance services and our CenterWell healthcare services, we make it easier for the millions of people we serve to achieve their best health - delivering the care and service they need, when they need it. These efforts are leading to a better quality of life for people with Medicare and Medicaid, families, individuals, military service personnel, and communities at large. Learn more about what we offer at Humana.com and at CenterWell.com. Equal Opportunity Employer\nIt is the policy of Humana not to discriminate against any employee or applicant for employment because of race, color, religion, sex, sexual orientation, gender identity, national origin, age, marital status, genetic information, disability or protected veteran status. It is also the policy of Humana to take affirmative action, in compliance with Section 503 of the Rehabilitation Act and VEVRAA, to employ and to advance in employment individuals with disability or protected veteran status, and to base all employment decisions only on valid job requirements. This policy shall apply to all employment actions, including but not limited to recruitment, hiring, upgrading, promotion, transfer, demotion, layoff, recall, termination, rates of pay or other forms of compensation and selection for training, including apprenticeship, at all levels of employment.","description_format":"text","description_chars":10804,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Home Care Services","Primary Care & Medical Centers","Pharmacies"],"lifecycle":[{"event":"open","at":"2026-08-11T00:00:00Z"},{"event":"close","at":"2026-08-25T05:22:53Z"},{"event":"reopen","at":"2026-09-30T18:37:32Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 339 · green card filings: 89","filings_12m":339,"filings_prev_12m":256,"green_card_filings_12m":89,"median_offered_wage_usd":137500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.223,"p_room":0.28,"age_days":70,"expected_fill_days":10,"reasons":["conf:36","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-20T05:45:00Z"},"pay":{"stated_usd_annual":161700,"is_top_pay":true},"html_url":"https://alion.io/job/humana-senior-engineer-offensive-security-2","json_url":"https://alion.io/job/humana-senior-engineer-offensive-security-2.json","meta":{"generated_at":"2026-10-20T10:11:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11127,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2742},"rest":"https://alion.io/mcp/rest/get_company?id=2742"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhumana-senior-engineer-offensive-security-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhumana-senior-engineer-offensive-security-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhumana-senior-engineer-offensive-security-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/humana-senior-engineer-offensive-security-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhumana-senior-engineer-offensive-security-2"}]}