WebApp Offensive Security Software Engineer

Horizon3.ai is a fast-growing, remote cybersecurity company dedicated to enabling organizations to proactively find and fix exploitable attack vectors. They are seeking a Senior/Staff Offensive Security Software Engineer with extensive web application penetration testing experience to design, develop, and integrate web application penetration testing content into their NodeZero platform.

Responsibilities:

• Perform hands-on, full-scope web application penetration tests against real customer applications, alongside benchmark and lab targets, to surface vulnerabilities and attack paths
• Review NodeZero results on live customer engagements to identify coverage gaps, blind spots, and missed opportunities — the edge cases and corner-case attack scenarios that autonomous testing doesn't yet handle
• Manually reproduce and validate those edge cases, building reliable, production-safe proof-of-concept exploits and clear test cases that demonstrate the gap end to end — including against live customer environments without disrupting them
• Partner closely with software engineers to translate your findings into product improvements — defining detection logic, attack content, expected behavior, and remediation so NodeZero handles those cases going forward
• Build and maintain a library of regression and benchmark test cases so newly added coverage doesn't silently regress over time
• Monitor production pentests for missed findings and false positives; create and triage Jira tickets to drive issues to resolution
• Work directly with customers and internal teams to investigate findings, explain attack paths, and address questions about web application coverage and results
• Author technical blog posts and research write-ups showcasing new exploits, edge cases, and attack methodologies
• Mentor teammates and contribute to continuous improvement of team processes, methodology, and testing standards

Requirements:

• Experience conducting full scope web application pentests
• Experience with proxy tools like Burp and with browser developer tools
• Proficient in object-oriented programming and test-driven development, with strong analytical and problem-solving skills
• Experience applying AI-assisted development tools to security research and automation tasks
• Curiosity about emerging AI technologies
• Skilled in designing, evaluating, and communicating technical solutions across systems, APIs, algorithms, and data structures
• Familiarity with relational and graph databases, particularly Postgres and Neo4j
• Strong written and verbal communication, including technical documentation
• Ability to manage multiple priorities, work independently, and mentor teammates of varying experience levels
• Quick to learn and adopt new technologies as needed
• History of recognized security research, including documented CVE discoveries and responsible disclosure
• Track record of successful bug bounty contributions
• Experience developing software and automation to aid in web application pentesting
• Background in large-scale software development projects
• Experience fine-tuning language models or implementing retrieval-augmented generation (RAG) for security-focused applications
• Experience with AI/LLM tools for building agentic workflows (e.g., LangChain, LangFlow) and integrating contextual data using protocols like Model Context Protocol (MCP)