Remote opportunity at
Group 1001Senior Offensive Security Engineer
Group 1001 operates as a consumer-focused, technology-enabled family of insurance companies that combines financial stability with insurance expertise and collaborative culture. The organization is currently hiring…
Career Tools
About This Role
Group 1001 operates as a consumer-focused, technology-enabled family of insurance companies that combines financial stability with insurance expertise and collaborative culture. The organization is currently hiring a remote, full-time Senior Offensive Security Engineer to act as the technical lead for its offensive testing operations. In this position, the engineer will oversee penetration testing, manage red and purple team exercises, run the private bug bounty initiative, and minimize external attack surfaces…
Job Description
Group 1001 operates as a consumer-focused, technology-enabled family of insurance companies that combines financial stability with insurance expertise and collaborative culture. The organization is currently hiring a remote, full-time Senior Offensive Security Engineer to act as the technical lead for its offensive testing operations. In this position, the engineer will oversee penetration testing, manage red and purple team exercises, run the private bug bounty initiative, and minimize external attack surfaces across cloud, application, API, and endpoint systems. The professional will collaborate closely with development teams to integrate security into release cycles and will report directly to the AVP of Security Lifecycle & Architecture. Qualified candidates will possess extensive background in offensive security, vulnerability triage, and risk prioritization.
Responsibilities
- Plan, scope, execute, and deliver reports for penetration tests across cloud environments, endpoints, applications, and APIs
- Partner with developers to align testing schedules with release cycles and enhance secure software development life cycle practices
- Lead quarterly red and purple team operations to simulate real-world attacks and test organizational resilience
- Manage the private bug bounty initiative by handling strategy, scope, triage, severity validation, and remediation coordination
- Run the enterprise continuous attack surface monitoring platform and drive external findings to closure
- Supervise third-party testing vendors and oversee the annual external penetration test
- Validate remediation efforts through retesting and track security findings with relevant stakeholders
- Translate offensive findings into defensive improvements by cooperating with security architecture, detection, and audit teams
- Develop and refine offensive tools, processes, and techniques to improve program efficiency
- Track and present program metrics, risk reduction, and security posture improvements to leadership and technical teams
Requirements
- Minimum of 8 years of hands-on experience in penetration testing, red teaming, or related offensive security roles
- Demonstrated experience testing cloud environments including Azure, AWS, and GCP
- Experience performing full-scope red team operations and purple team exercises
- Background in vulnerability triage, risk prioritization, and guiding remediation teams
- Experience managing or heavily contributing to a bug bounty program
- Familiarity with continuous attack surface management platforms and external exposure reduction
- Understanding of adversary tactics, techniques, and procedures alongside modern detection and response tools
- Strong communication skills for presenting findings and risk to executives and non-technical stakeholders
Qualifications
- Experience developing custom tooling, exploits, implants, payloads, or evasion techniques
- Familiarity with commercial and open-source offensive tools such as Cobalt Strike, custom C2 frameworks, and Burp Suite
- Programming or scripting proficiency in languages like Python, PowerShell, C/C++, or Rust
- Relevant professional certifications including OSCP, OSWE, OSCE, GXPN, or equivalent expertise
- Experience working with or managing third-party penetration testing vendors
- Background working with development teams on secure SDLC, DevSecOps, or secure code reviews
- Knowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives
- Prior experience in financial services, insurance, or other regulated environments such as NYDFS 23 NYCRR 500
- Prior experience mentoring or leading other security engineers
Core Skills
Benefits
- Comprehensive health, dental, and vision insurance plan options for employees and their families
- Basic and supplemental life insurance coverage
- Short-term and long-term disability insurance
- Immediate access to an employee assistance program and wellness programs with no enrollment required
- Participation in a 401(k) plan with company matching contributions
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the posting specifies that the role is remote.
What is the employment type?
The position is full-time.
What is the salary range for this role?
The base pay ranges from $200,000 per year in the lowest geographic market up to $270,000 per year plus bonus in the highest geographic market, depending on market location, knowledge, skills, and experience.
How many years of experience are required?
The role requires eight or more years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.