{"id":26067,"url":"https://alion.io/job/toters-delivery-senior-security-engineer","title":"Senior Offensive Security Engineer","company":{"id":6942,"name":"Toters","domain":"totersapp.com","url":"https://alion.io/company/toters-delivery","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"BambooHR","truth_index":{"grade":"C","score":67,"open_postings":49,"ghost_share":0.469,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":83,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Jdeideh, Lebanon"],"countries":["LB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":69000,"max_usd":158000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Burp Suite","optional":false},{"name":"Cobalt Strike","optional":false},{"name":"Metasploit","optional":false},{"name":"MobSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"LLM","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"Tokenization","optional":true}],"status":"live","first_seen_at":"2026-07-02T00:00:00Z","employer_posted_date":"2026-07-02","last_verified_at":"2026-10-29T16:35:07Z","board_verified":true,"closed_at":null,"days_open":119,"trust":{"level":"ok","repost_count":1,"flags":["company_stale"],"days_open":119},"description":"The Company\nToters is an on-demand e-commerce and delivery platform that enables customers to get anything in their city with the highest level of convenience.\nAt Toters, technology is at the heart of everything we do. Our product teams build features that simplify customers’ lives, while our engineers create scalable solutions to deliver faster and more cost-effectively. If you thrive in a high-growth startup environment and want to help reshape how people shop across the Middle East, join us.\nRole Overview\nAs a Senior Offensive Security Engineer (L5), you will own complex offensive security initiatives that span multiple teams. You will lead advanced penetration testing, red team exercises, and adversarial simulations to uncover systemic weaknesses in our web applications, APIs, mobile apps, cloud infrastructure, identity, payment-adjacent flows, and overall attack surface.\nYou will act as a hands-on technical leader: influencing secure design decisions with evidence, mentoring mid-level and junior offensive engineers, and driving improvements that meaningfully reduce risk.\nDescription\nIn this senior role, you will take end-to-end ownership of offensive security efforts with a focus on high-impact outcomes. Your responsibilities include:\nLead comprehensive penetration tests and red team / assumed-breach exercises targeting web applications, APIs, mobile applications, cloud infrastructure, and authentication systems (including identity and privileged-access paths).\nLead mobile offensive testing on Android and iOS, including evaluation and bypass/validation of runtime protection, tamper resistance, certificate pinning / Certificate Transparency, and key/secret shielding using DexProtector or similar RASP / app-shielding tools, plus complementary tooling such as MobSF.\nPerform in-depth threat modeling and identify complex attack paths across services and trust boundaries (including authorization flaws, tenant isolation, token/session issues, edge/WAF bypass, and client-secret exposure).\nDeliver high-quality security assessment reports with clear risk ratings, business impact analysis, practical remediation guidance, and evidence quality that engineering and audit stakeholders can use in a SOC 2 and PCI DSS context-then re-test and validate fixes before closure.\nCollaborate with Engineering, DevOps, Product, and the Security Engineer track to influence secure architecture decisions and ensure vulnerabilities are addressed at the root cause.\nDevelop and improve offensive security methodologies, tools, and automation to increase efficiency and coverage. AI-assisted testing is a must.\nMentor mid-level and junior offensive security engineers, conduct offensive-focused code/design reviews, and help raise the overall security capability of the team.\nParticipate in purple team exercises with the detection and incident response teams to improve defenses based on real attack simulations.\nStay at the forefront of offensive security research, emerging threats, and TTPs, and assess their relevance to Toters.\nContribute offensive input to security standards, policies, and secure development practices across the engineering organization (you advise; you do not own policy issuance or GRC evidence packs).\nSupport structured disclosure (VDP / researcher reports) through reproduce, rate, de-duplicate, and validate.\nKey Qualifications\nBachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.\n6+ years of hands-on experience in offensive security, penetration testing, or red teaming.\nStrong expertise in web application, API, and mobile security testing (Android and iOS).\nWorking knowledge of DexProtector or similar mobile shielding / RASP tooling: what it protects, how testers evaluate residual risk, and how to validate that hardening holds.\nAdvanced proficiency with offensive security tools (Burp Suite, Metasploit, Cobalt Strike or equivalent adversary-emulation platforms, custom tooling, etc.).\nProficient in writing robust, reusable scripts and small tools for automation (Python preferred, Bash for quick tasks).\nSolid experience with cloud security testing (AWS preferred) and infrastructure attack techniques.\nProven ability to lead complex security assessments from scoping to reporting and remediation validation.\nStrong risk assessment and threat modeling skills, with the ability to communicate technical risks clearly to both technical and non-technical stakeholders.\nFamiliarity with SOC 2 and PCI DSS as they apply to offensive work (scoped pentests, application/API/payment-adjacent testing, evidence-quality reporting). This role does not own control design or audit evidence collection.\nExperience mentoring engineers and influencing cross-team security practices.\nExcellent written and verbal communication skills in English.\nNice to Have\nIndustry-recognized certifications such as OSCP, OSCE, OSEP, CRTO, or PNPT.\nExperience running full-scope red team or assumed-breach exercises.\nExperience developing custom exploits, tooling, or automation for offensive security.\nKnowledge of MITRE ATT&CK and adversary emulation.\nAI and AI pentesting: testing LLM/agent applications (prompt injection, tool/plugin abuse, data-exfil via agents) and using AI-assisted pentest workflows with mandatory human review.\nPrevious experience in high-scale e-commerce, delivery, or fintech environments, including payment API / tokenization / third-party PSP testing as a tester (not as PCI control owner).\nFluency in Arabic and English (French is a plus).\nWhat We Offer\nCompetitive compensation package.\nDiscounts on Toters orders.\nFirst-class medical insurance.\nReady to own offensive security at scale and help build a safer platform for millions across the Middle East? Apply now!","description_format":"text","description_chars":5783,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false},{"language":"Arabic","level":"Advanced (C1)","optional":true}]},"benefits":["Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Food & Beverages","Transportation & Logistics","Delivery"],"lifecycle":[{"event":"open","at":"2026-07-02T00:00:00Z"},{"event":"close","at":"2026-09-23T10:26:09Z"},{"event":"reopen","at":"2026-09-25T17:04:17Z"}],"visa":[],"liveness":{"score":31,"band":"fade","label":"Fading","p_open":1,"p_active":0.708,"p_room":0.44,"age_days":119,"expected_fill_days":83,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/toters-delivery-senior-security-engineer","json_url":"https://alion.io/job/toters-delivery-senior-security-engineer.json","meta":{"generated_at":"2026-10-29T19:27:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28887,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6942},"rest":"https://alion.io/mcp/rest/get_company?id=6942"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftoters-delivery-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftoters-delivery-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftoters-delivery-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/toters-delivery-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftoters-delivery-senior-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":26067}},{"tool":"search_jobs","arguments":{"company":"totersapp.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":26067},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}