{"id":11506,"url":"https://alion.io/job/sporty-group-offensive-security-engineer","title":"Offensive Security Engineer","company":{"id":172451,"name":"Sporty Group","domain":"sportygroup.com","url":"https://alion.io/company/sporty-group-2","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":95,"open_postings":22,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":110,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":89000,"max_usd":205000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2094},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Bash","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"DNS","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-07-07T07:44:49Z","employer_posted_date":"2026-09-25","last_verified_at":"2026-10-17T15:00:55Z","board_verified":true,"closed_at":null,"days_open":102,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":101},"description":"About the role\nMission: Emulate the full kill chain of the real-world adversaries that target our business. As our Red Team Expert, you plan and execute full-scope, objective-driven operations from external initial access through phishing, C2, lateral movement, privilege escalation, and Active Directory domain compromise, all the way to actions on objective against our most critical assets. You operate covertly against a mature, monitored environment, defeat modern EDR/XDR and detection controls, and prove exactly how far a determined attacker could get. You then turn every operation into concrete detection engineering wins and defensive improvements alongside our Blue Team.\nWhat you'll be doing\nScope, plan, and execute full-scope red team engagements and long-horizon adversary emulation campaigns mapped to real threat-actor TTPs and the MITRE ATT&CK framework.\nExecute the complete attack chain: OSINT and reconnaissance, initial access (phishing, payload delivery, public-facing exploitation), establishing and operating covert C2, persistence, privilege escalation, lateral movement, and domain/cloud takeover.\nDevelop and deploy custom tooling, payloads, and C2 infrastructure; build and maintain resilient, OPSEC-safe redirector and command-and-control environments.\nResearch and weaponize EDR/XDR evasion and bypass techniques - in-memory execution, process injection, AMSI/ETW tampering, and defense-evasion tradecraft - against CrowdStrike, SentinelOne, and Microsoft Defender XDR.\nCompromise Active Directory and hybrid/cloud identity: Kerberos attacks, ACL and delegation abuse, ADCS exploitation, and lateral movement across on-prem and cloud infrastructure (AWS).\nRun assumed-breach, insider-threat, and social-engineering scenarios, including physical and office-network intrusion paths where in scope.\nWork directly with the Blue Team to replay attack chains, validate and tune detections, and measurably close detection and response gaps.\nDocument full attack narratives, kill-chain diagrams, and reproducible proof-of-concept steps that let defenders rebuild and detect every stage.\nTranslate operational findings into prioritized, actionable remediation and detection-engineering guidance for IT, Network, and Security teams.\nTrack operational metrics: objectives achieved, detection and response times, dwell time, evasion success rates, and remediation follow-through.\nContribute to maturing Sporty's red team capability and threat-informed defense, sharing tradecraft with internal offensive and defensive staff.\nWhat you'll bring\nExperience (required)\n 5+ years of hands-on experience in offensive security, perimeter penetration testing, network security assessments, red teaming, or adversary emulation.\nStrong understanding of external asset discovery, DNS configuration vulnerabilities, and public IP network routing.\nPractical experience auditing and testing Linux and Windows environments and underlying network services.\nProven ability to perform adversary emulation and bypass techniques against modern EDR/XDR solutions.\nFamiliarity with testing physical office network hardware, routers, switches, firewalls, and workplace IT systems.\nAbility to turn external exposures and technical network risks into clear, actionable fixes for IT and Security teams.\nExperience with core web vulnerabilities and limited, scoped testing of modern API interfaces.\nStrong scripting ability in Python, PowerShell, Bash, or similar to automate perimeter mapping, emulation workflows, and asset discovery.\nGood understanding of scanning, reconnaissance, and interception tools.\nStrong documentation skills.\nCertifications (one or more required)\nOffSec: OSCP / OSCP+, OSEP, OSWE, OSED, OSCE3 (or legacy OSCE), OSWA, OSMR, OSEE\nHack The Box: CPTS, CBBH, CWEE, CAPE\nRed Team / Active Directory: CRTO, CRTL (Zero-Point Security); CRTP, CRTE, CRTM (Altered Security)\nGIAC: GPEN, GXPN, GWAPT, GRTP, GCPN\nOther recognized: PNPT (TCM Security), eCPPT / eWPTX / eMAPT (INE), BSCP (PortSwigger), CREST CRT / CCT, CPTE\nCommunity and competitive track record\nBug bounty recognition: bounty awards, hall-of-fame listings, or published CVEs through HackerOne, Bugcrowd, Intigriti, YesWeHack, or vendor-run programs.\n CTF achievements: active player on a ranked CTFtime team, Hack The Box Hall of Fame or Pro Lab completions, or finalist/podium placements in recognized competitions (DEF CON CTF, Google CTF, HTB Business CTF, SANS Holiday Hack, and similar).\nWhat’s in it for you\nSporty is a remote first company in pursuit of sustainability\nA competitive salary + individual performance based bonuses every quarter\n28 days paid annual leave\nOur core working hours are 10am-3pm in your local time zone with flexibility outside of this\nReferral bonuses & flash bonuses\nTop of the line equipment\nAnnual company retreats to provide great internal networking opportunities\nInterview process\nRemote video screening with our Talent Acquisition Team \nOffline Take home assignment\nRemote video interview with Team Members (60 Mins)\nFinal discussion with the hiring manager (60 mins)\nIf you're interested, we encourage you to apply! Every application is reviewed by a member of our team (AI is not used in our recruitment process), and we aim to respond within 48 hours. We are committed to maintaining a fair, secure and authentic recruitment process. Applications submitted using false, misleading or fraudulent information, including impersonated or fake profiles, will not be considered. Where reasonably necessary to protect the integrity and security of our recruitment process, we may verify a candidate’s identity and/or the accuracy of information provided during the recruitment process. Any such checks will be carried out in a proportionate and appropriate manner and in accordance with applicable data protection and employment laws.","description_format":"text","description_chars":5847,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Performance based bonus"],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"region"},{"name":"France","iso":"FR","kind":"region"},{"name":"United Kingdom","iso":"GB","kind":"region"},{"name":"Austria","iso":"AT","kind":"region"},{"name":"Belgium","iso":"BE","kind":"region"},{"name":"Bulgaria","iso":"BG","kind":"region"},{"name":"Croatia","iso":"HR","kind":"region"},{"name":"Czech Republic","iso":"CZ","kind":"region"},{"name":"Denmark","iso":"DK","kind":"region"},{"name":"Finland","iso":"FI","kind":"region"},{"name":"Hungary","iso":"HU","kind":"region"},{"name":"Ireland","iso":"IE","kind":"region"},{"name":"Italy","iso":"IT","kind":"region"},{"name":"Netherlands","iso":"NL","kind":"region"},{"name":"Norway","iso":"NO","kind":"region"},{"name":"Poland","iso":"PL","kind":"region"},{"name":"Romania","iso":"RO","kind":"region"},{"name":"Spain","iso":"ES","kind":"region"},{"name":"Sweden","iso":"SE","kind":"region"},{"name":"Switzerland","iso":"CH","kind":"region"},{"name":"Estonia","iso":"EE","kind":"region"},{"name":"Greece","iso":"GR","kind":"region"},{"name":"Iceland","iso":"IS","kind":"region"},{"name":"Latvia","iso":"LV","kind":"region"},{"name":"Liechtenstein","iso":"LI","kind":"region"},{"name":"Lithuania","iso":"LT","kind":"region"},{"name":"Luxembourg","iso":"LU","kind":"region"},{"name":"Malta","iso":"MT","kind":"region"},{"name":"Portugal","iso":"PT","kind":"region"},{"name":"Slovakia","iso":"SK","kind":"region"},{"name":"Slovenia","iso":"SI","kind":"region"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Sports Betting","Sports Media","iGaming & Gambling"],"lifecycle":[{"event":"open","at":"2026-07-07T07:44:49Z"}],"visa":[],"liveness":{"score":48,"band":"ok","label":"Likely open","p_open":1,"p_active":0.792,"p_room":0.6,"age_days":101,"expected_fill_days":110,"reasons":["conf:0","win:late","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/sporty-group-offensive-security-engineer","json_url":"https://alion.io/job/sporty-group-offensive-security-engineer.json","meta":{"generated_at":"2026-10-17T16:04:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21923,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":172451},"rest":"https://alion.io/mcp/rest/get_company?id=172451"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsporty-group-offensive-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsporty-group-offensive-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsporty-group-offensive-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sporty-group-offensive-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsporty-group-offensive-security-engineer"}]}