{"id":694522,"url":"https://alion.io/job/twenty-offensive-cyber-research-engineer","title":"Offensive Cyber Research Engineer","company":{"id":685785,"name":"Twenty","domain":"twenty.io","url":"https://alion.io/company/twenty-2","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":95,"open_postings":29,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":147,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Arlington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":159000,"max":263000,"currency":"USD","period":"year","gross":null,"usd_annual":263000},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cobalt Strike","optional":false},{"name":"Docker","optional":false},{"name":"ETL/ELT","optional":false},{"name":"Go","optional":false},{"name":"Kubernetes","optional":false},{"name":"Metasploit","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Neo4j","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Agile","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true}],"status":"live","first_seen_at":"2025-10-12T17:19:25Z","employer_posted_date":"2025-10-12","last_verified_at":"2026-10-23T20:31:50Z","board_verified":true,"closed_at":null,"days_open":376,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":375},"description":"About the Company\nAmerica is under sustained cyber attack. Our adversaries infiltrate our networks, steal our IP, and degrade the digital infrastructure that modern life runs on. They’ve learned-correctly-that those attacks rarely produce consequences.\nTwenty was founded to change that, by making our adversaries think twice before they attack us. Our vision is American and allied primacy in cyberspace-a future where they cannot contest us, deterrence is assured, and the free world remains secure.\nFounded in 2024, Twenty Technologies (www.twenty.io) industrializes offensive cyber operations for the U.S. and its allies. Headquartered in Arlington, Virginia, Twenty has raised $168M from Khosla Ventures, Accel, Caffeinated Capital, Friends & Family Capital, Point72 Ventures, General Catalyst, and In-Q-Tel.\nMission | On Site | Full Time | Active TS/SCI with CI Polygraph\nRole Summary\nTwenty is seeking an exceptionally skilled Offensive Cyber Research Engineer for an in-office position in its Arlington, VA office to lead the development of sophisticated offensive cyber capabilities that defend democracies worldwide. We're looking for someone with 6-8 years of deep technical expertise in offensive cyber operations, software development, and research, combined with proven leadership experience mentoring engineers and driving strategic technical initiatives. In this role, you'll architect and lead the development of advanced attack path frameworks, establish engineering best practices for offensive tooling, mentor junior researchers, and serve as a technical authority on adversarial techniques and red team operations. You'll leverage your extensive operational background-ideally from government/military Digital Network Exploitation Analysis (DNEA), Exploitation Analyst (EA) operations, advanced penetration testing, or threat intelligence analysis-to shape the technical direction of our offensive cyber capabilities and build the next generation of cyber technologies for the United States and its allies.\nWhat You'll Do\nTechnical Leadership & Architecture\nLead the architecture and design of sophisticated attack path frameworks that emulate advanced persistent threat (APT) behaviors and nation-state TTPs\n\nEstablish technical standards and best practices for offensive cyber tool development across the organization\n\nEvaluate and recommend engineering courses of action for new offensive capabilities and system enhancements\n\nDrive technical decision-making for complex offensive cyber integrations and performance optimizations\n\nArchitect scalable, modular frameworks for attack technique automation and adversary emulation\n\nResearch & Innovation\nConduct advanced research into emerging adversary techniques, zero-day exploitation strategies, and novel attack vectors\n\nDevelop proof-of-concept tools and techniques that push the boundaries of offensive cyber capabilities\n\nStay current with threat actor innovations and translate emerging TTPs into defensive and offensive capabilities\n\nPublish internal research findings and contribute to the broader cyber security research community\n\nIdentify capability gaps and lead initiatives to develop new offensive tools and methodologies\n\nTeam Leadership & Mentorship\nMentor and provide technical guidance to offensive cyber engineers and researchers, conducting thorough code reviews and knowledge transfer\n\nLead technical discussions and facilitate strategic planning sessions for offensive capability development\n\nOrganize research efforts and coordinate cross-functional collaboration with data engineering, backend, and intelligence analysis teams\n\nEstablish and maintain engineering best practices, secure coding standards, and operational security procedures\n\nGuide junior engineers in understanding complex adversary behaviors and translating them into technical implementations\n\nAttack Path Development & Implementation\nDesign and implement advanced attack paths that emulate sophisticated adversary campaigns across multiple domains\n\nCreate reusable, production-grade components for complex attack techniques including credential harvesting, lateral movement, and defense evasion\n\nDevelop custom tooling and automation frameworks that operate at machine speed for large-scale adversary emulation\n\nData Engineering & Intelligence Integration\nLead the design of ETL pipelines for processing threat intelligence, security logs, and operational data at scale\n\nArchitect standardized schemas for cyber operations datasets that support graph-based analysis and AI/ML workflows\n\nImplement advanced data enrichment pipelines that integrate diverse threat intelligence sources\n\nDesign efficient storage and retrieval systems for large-scale security-relevant data\n\nOperational Collaboration\nWork closely with government customers and operational teams to understand mission requirements and capability gaps\n\nTranslate operational feedback into technical requirements and development priorities\n\nLead technical demonstrations showcasing offensive cyber capabilities to stakeholders\n\nProvide subject matter expertise for customer engagements and strategic planning sessions\n\nMust Have\nTechnical Skills & Experience\n6-8 years of threat research, offensive cyber operations, and software development experience\n\nExpert-level operational cyber security experience in one or more of the following domains:\nDigital Network Exploitation Analysis (DNEA) within U.S. Government military or intelligence organizations\n\nExploitation Analyst (EA) operations conducting advanced network exploitation and intelligence analysis\n\nAdvanced Penetration Testing/Red Teaming leading sophisticated offensive security assessments\n\nSenior-level Threat Hunting and threat intelligence analysis in high-stakes environments\n\nDemonstrated technical leadership experience mentoring offensive cyber engineers and leading research initiatives\n\nDeep expertise in the MITRE ATT&CK framework with proven track record developing and implementing advanced adversary TTPs across multiple tactics\n\nExpert-level experience operating and extending industry-standard threat emulation platforms (Cobalt Strike, Metasploit, custom C2 frameworks) with proven ability to develop sophisticated custom payloads, modules, and evasion techniques\n\nExtensive experience integrating and analyzing diverse threat intelligence sources including commercial feeds, OSINT, and government intelligence\n\nAdvanced proficiency in implementing sophisticated persistence mechanisms, advanced defense evasion techniques, counter-forensics, and anti-analysis methods\n\nExpert containerization and orchestration experience using Docker and Kubernetes for secure, scalable offensive tool deployment\n\nAdvanced programming and software architecture skills in Python and Golang, with demonstrated ability to build maintainable, production-grade security tools and automation frameworks\n\nExpert-level experience writing complex graph queries and developing graph-based analytical tools using Neo4j or similar graph databases\n\nComprehensive knowledge of cybersecurity across network security, application security, secure coding, cryptography, and security architecture\n\nExtensive practical experience in offensive cyber operations including advanced payload development, post-exploitation frameworks, command and control infrastructure, and multi-stage attack chains\n\nExpert knowledge of red team methodologies including campaign planning, operational security (OPSEC), adversary simulation, and realistic threat emulation based on intelligence-driven scenarios\n\nLeadership & Communication Skills\nProven ability to lead technical projects and mentor engineering teams\n\nStrong communication skills with ability to explain complex offensive techniques to diverse audiences including executives and government officials\n\nExperience conducting thorough code reviews and establishing development standards for security tools\n\nTrack record of driving technical decision-making and influencing strategic direction\n\nEducation\nBachelor's degree in Computer Science, Software Engineering, Cybersecurity, or related field; Master's degree preferred, or equivalent practical experience\n\nSecurity Requirements\nMust be eligible to obtain a U.S. Government security clearance\n\nNice to Have\nPrevious technical leadership experience in government cyber operations units or intelligence organizations conducting DNEA or EA operations\n\nExperience leading offensive cyber capability development programs or research initiatives\n\nTrack record of developing novel offensive techniques or tools adopted by operational units\n\nAdvanced certifications such as OSCP, OSCE, OSEE, GXPN, or government-recognized advanced offensive security credentials\n\nExperience with AI/ML integration in offensive cyber operations and automated threat emulation\n\nExtensive background in malware analysis, reverse engineering, exploit development, or vulnerability research\n\nExperience with multi-domain intelligence analysis correlating cyber, SIGINT, ELINT, and other intelligence sources\n\nPublications or conference presentations on offensive cyber research or techniques\n\nContributions to open-source offensive security tools or frameworks\n\nAdditional Skills\nExperience with Agile development methodologies and leading agile teams\n\nAdvanced system architecture and design experience for large-scale security systems\n\nPerformance optimization and scalability experience for high-throughput data processing\n\nExperience with cloud security (AWS, Azure, GCP) and cloud-native attack techniques\n\nDeep knowledge of wireless security, IoT protocols, and electromagnetic spectrum operations\n\nExpertise with forensics tools, incident response procedures, and defensive cyber operations\n\nUnderstanding of government acquisition processes and requirements development\n\nBenefits\nWhat's on the table:\nHealth. Medical, dental, and vision plan options. Life / AD&D, disability coverage options.\n\nFamily. Paid parental leave for eligible full-time employees. 12 weeks for birthing parents, 4 for non-birthing parents, 6 weeks for adoptive, foster, or intended parents through surrogacy.\n\nVacation. Paid holidays and flexible PTO. Take what you need.\n\nRetirement. 401(k) with pre-tax and Roth options. HSA/FSA options, dependent care FSA.\n\nBenefits vary by location, role, and eligibility. Full plan details provided during the interview and offer process.\nIf this role sounds like you, apply and share with us your interest\nDue to U.S. government contract and security requirements, this role is limited to U.S. citizens. Some positions may also require eligibility to obtain and maintain a U.S. Government security clearance. Any active clearance requirement will be listed in the role description.\nTwenty is an equal opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, veteran status, disability, or any other protected status, consistent with applicable law.\nIf you need a reasonable accommodation during the hiring process, let us know and we will work with you.","description_format":"text","description_chars":11121,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cyber Warfare","Penetration Testing","National Security"],"lifecycle":[{"event":"open","at":"2026-09-11T01:41:42Z"}],"visa":[],"liveness":{"score":18,"band":"cold","label":"Long shot","p_open":1,"p_active":0.64,"p_room":0.28,"age_days":375,"expected_fill_days":147,"reasons":["conf:3","velocity","win:tail","crowd:"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":263000,"is_top_pay":true},"html_url":"https://alion.io/job/twenty-offensive-cyber-research-engineer","json_url":"https://alion.io/job/twenty-offensive-cyber-research-engineer.json","meta":{"generated_at":"2026-10-23T23:23:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6736,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":685785},"rest":"https://alion.io/mcp/rest/get_company?id=685785"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftwenty-offensive-cyber-research-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftwenty-offensive-cyber-research-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftwenty-offensive-cyber-research-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/twenty-offensive-cyber-research-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftwenty-offensive-cyber-research-engineer"}]}