Offensive Security Engineer — Fully Remote

CoTrain is hiring an experienced offensive security specialist for a fully authorized engagement to test CRM and related systems. The role involves performing penetration tests, identifying attack paths, documenting findings, and delivering actionable remediation guidance.

Responsibilities:

• Perform an authorized penetration test of the CRM and related systems within an agreed scope
• Identify and demonstrate real attack paths across credentials, permissions, APIs, and identity
• Show, under controlled conditions, where client data could be accessed
• Document findings with clear evidence and reproducible steps
• Deliver actionable, prioritized remediation guidance the team can implement to close the gaps

Requirements:

• Proven experience in offensive security, penetration testing, or red teaming
• Strong grasp of identity, access control, API, and permission-based attack paths
• Experienced testing SaaS/CRM or similar business-critical systems
• Rigorous about scope, authorization, and responsible disclosure — you operate strictly within rules of engagement
• Excellent reporting skills: you translate technical findings into clear, actionable remediation for both engineers and leadership
• Relevant certifications (OSCP, OSCE, GPEN, GWAPT, or similar)
• Cloud security experience (AWS / GCP / Azure)
• Familiarity with common CRM platforms and their integration/API surfaces