Senior Security Engineer (Offensive & Application Security)
Confirmed on the employer's own hiring board on Nov 6, 2026. First seen by Alion on Nov 4, 2026.
About the role
This is the one security engineer we can point at almost any engagement and trust to deliver. The work leans offensive: network and application penetration testing, web and PHP application exploitation, and adversarial testing of AI and LLM systems. It also carries the defensive and governance range to stand the function up from zero, because a one-person security team cannot only break things, it has to build the controls, write the policies, and pass the audits too.
You will operate across Plutus21 and its clients, so the same person who runs a red-team exercise one week documents SOC 2 evidence the next. We want depth in offense and competence across the rest. You set the foundations, you build the tooling and the processes, and you help hire the pod as the demand grows.
What you will do
Offensive security (primary)
Run full-scope penetration tests against networks, applications, APIs, and cloud environments, following a recognized method (PTES or equivalent), from scoping to retest.
Perform red-team and adversary-simulation exercises mapped to MITRE ATT&CK, chaining findings into realistic attack paths rather than reporting isolated vulnerabilities.
Conduct social-engineering and phishing assessments where the engagement authorizes them.
Deliver findings with proof-of-concept, business impact, a severity rating (CVSS), and remediation that an engineer can act on.
Web and PHP application attacks
Exploit and report the full OWASP Top 10 class of flaws: injection, broken access control, authentication and session weaknesses, SSRF, insecure deserialization, and the rest.
Carry deep, hands-on PHP application testing (Laravel, WordPress, and legacy custom stacks): source-assisted review, object-injection and deserialization chains, file-upload and LFI/RFI abuse, and common CMS and plugin weaknesses.
Test APIs (REST and GraphQL) and single-page front ends against current attack classes.
AI and LLM attacks
Red-team AI and LLM systems against the OWASP LLM Top 10: prompt injection (direct and indirect), jailbreaks, data and system-prompt exfiltration, insecure tool and plugin use, training-data and supply-chain risks, and model denial of service.
Test the agent and RAG systems Plutus21 builds for clients, including tool-call abuse and data-isolation failures.
Translate AI findings into guardrails and test cases engineering can adopt.
Application security in the pipeline
Embed secure development practice with engineering: threat modeling, secure code review, and security testing (SAST, DAST, dependency and secret scanning) wired into CI/CD.
Cloud, infrastructure, and identity
Design, deploy, and maintain security controls across cloud (AWS preferred), corporate infrastructure, endpoints, and identity.
Manage identity and access on a least-privilege basis, with MFA and periodic access reviews.
Stand up and run cloud security posture management.
Security operations and incident response
Monitor for threats and vulnerabilities, triage alerts, and lead detection, response, and post-incident review.
Select, deploy, and run the tooling: SIEM, EDR, vulnerability scanning, and CSPM.
Governance, risk, and compliance
Write and maintain security policies, standards, and procedures against recognized frameworks.
Drive compliance and audit readiness for SOC 2, ISO 27001, and NIST CSF, including evidence collection and control mapping.
Assess the security posture of vendors and client environments, and return clear, prioritized remediation.
Client delivery and building the pod
Report risks, incidents, and metrics clearly to leadership and client stakeholders, and explain technical risk to non-technical audiences.
Deliver security awareness training to internal teams.
Define the structure, roadmap, and hiring plan for the security pod as it grows.
First 90 days
Run a first internal penetration test across Plutus21's own cloud, identity, and key applications, and return a prioritized remediation plan.
Stand up the core tooling baseline: vulnerability scanning, EDR, and a path to SIEM and CSPM.
Deliver one external client engagement end to end (pentest or AI red-team) with a client-ready report.
Publish the first version of the security policy set and the SOC 2 control map.
What we need
At least five years hands-on in cybersecurity, with real offensive depth (penetration testing or red-teaming as a core part of the work, not a side task).
A proven web application testing track record, including PHP-heavy stacks (Laravel, WordPress, or legacy custom code).
Command of the OWASP Top 10 and modern web and API attack classes, with the ability to show working exploits, not just scanner output.
Working knowledge of AI and LLM attack surface (prompt injection, jailbreaks, agent and RAG abuse), or the demonstrated ability to pick it up fast.
Strong working knowledge of at least one major cloud platform (AWS preferred) and its native security services.
Practical incident response, threat detection, and log analysis with SIEM and EDR.
Solid grounding in networking, operating systems, identity management, and encryption.
Scripting and automation in Python, Bash, or PowerShell.
Experience with at least one compliance framework: SOC 2, ISO 27001, or NIST CSF.
The temperament to own a function from the ground up: self-directed, able to prioritize under pressure, and comfortable being the only security person in the room for a while.
Excellent written and spoken English, with the ability to turn technical risk into plain language for non-technical stakeholders. The report is half the job.
Nice to have
Offensive certifications: OSCP (strongly preferred), OSWE, OSEP, or CRTP.
Broader credentials: CISSP, CEH, CompTIA Security+, or a recognized cloud security certification.
A public track record: bug bounty results, CVEs, published research, or a tool or write-up portfolio.
Burp Suite Professional fluency and custom tooling or extension development.
Hands-on AI red-teaming experience against production LLM or agent systems.
Exposure across more than one cloud, and experience in a consulting or multi-client delivery setting.