Parameter
Offensive Security Engineer
$180K–$250K
San Francisco, CA, US · Full-time · Posted Oct 5, 2026
- Experience
- 3+ years; alternatives: web application pentesting, red teaming, or serious bug bounty work.
- Visa sponsorship
- Must be authorized to work in the US; visa sponsorship is not available.
About the job
Conduct offensive security testing for customer applications and cloud environments, then encode testing methods into Parameter’s AI agents and support customer engagements.
What you'll do
- Run manual penetration tests against customer web applications, APIs, and cloud infrastructure; validate and triage agent findings.
- Develop agent capabilities, including attack modules, detection logic, and verification steps; contribute to vulnerability research and responsible disclosure.
- Lead technical customer engagements, including scoping calls and findings walkthroughs.
What they ask for
- 3+ years of hands-on offensive security experience in web application pentesting, red teaming, or serious bug bounty work.
- Deep knowledge of web application vulnerabilities, especially access control, authentication, and business logic flaws.
- Cloud security experience with AWS or GCP, including IAM, misconfiguration, and privilege escalation paths.
- Ability to write code and build tooling, and communicate clearly with engineers and executives.
Nice to have
- OSCP or OSWE; published CVEs, bug bounty leaderboard placement, or conference talks.
Pay
$180K – $250K (USD; base salary)
Tools
TypeScript, AWS, GCP
AI focus
Translate offensive security methodology into AI agent capabilities, validate and triage agent findings, and improve autonomous penetration testing.
Model-written summary · the original posting is authoritative