Senior Offensive Security Engineer

Group 1001 is a consumer-centric, technology-driven family of insurance companies on a mission to deliver outstanding value and operational performance by combining financial strength and stability with deep insurance expertise and a can-do culture. Group1001’s culture emphasizes the importance of collaboration, communication, core business focus, risk management, and striving for outcomes. This goal extends to how we hire and onboard our most valuable assets – our employees.

Why This Role Matters:

Group 1001 is seeking a hands-on Senior Offensive Security Engineer to lead penetration testing and red team operations across our cloud, endpoint, application, and API environments. You will be the technical owner of our offensive testing program: planning and performing penetration tests, running red and purple team exercises, managing our private bug bounty program, and reducing our external attack surface.

As our application security and SDLC practices mature, you will also embed with development teams, align testing to their release cycles, and help move security testing earlier in the lifecycle. This role reports to the AVP of Security Lifecycle & Architecture and works closely with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit. If additional headcount is approved, you will provide technical direction and mentorship to a second offensive security engineer.

How You'll Contribute:

• Plan, scope, execute, and report on penetration tests across Azure, AWS, and GCP environments, endpoints, internal web and desktop applications, and APIs, with clear, prioritized remediation guidance.
• Partner with development teams to learn their release schedules, plug testing into their delivery cycles, and help mature application security and SDLC practices.
• Lead and perform quarterly red team and purple team operations that simulate real-world adversary tactics to test detection, response, and overall resilience.
• Manage the private bug bounty program, including strategy, scope, vulnerability triage, severity validation, and coordination of remediation with internal teams.
• Operate the enterprise continuous attack surface monitoring platform, triage external findings, and drive remediation to closure.
• Oversee third-party testing vendors, including the annual external penetration test: define scope and objectives, review deliverables, and ensure results align with internal priorities and regulatory expectations.
• Validate remediation through retesting and track findings to closure with application, infrastructure, and security owners.
• Translate offensive findings into defensive improvements by working with Security Architecture, Detection Engineering, Threat & Fraud Defense, and Audit.
• Develop and refine offensive tooling, techniques, and processes to improve the effectiveness and efficiency of the program.
• Track and report program metrics, risk reduction, and security posture improvements, and present results to technical teams and senior leadership.
• Provide technical leadership, coaching, and work direction to additional offensive security team members as the team grows.

What We're Looking For:

• 8+ years of hands-on experience in penetration testing, red teaming, or equivalent offensive security roles.
• Demonstrated experience performing penetration tests against cloud environments (Azure, AWS, and/or GCP), endpoints, web and desktop/native applications, and APIs.
• Experience conducting full-scope red team operations and purple team exercises.
• Strong background in vulnerability triage, risk prioritization, and guiding remediation with development, infrastructure, and security teams.
• Experience managing or significantly contributing to a bug bounty program.
• Familiarity with continuous attack surface management platforms and external exposure reduction.
• Solid understanding of adversary tactics, techniques, and procedures (TTPs) and modern detection and response capabilities.
• Excellent written and verbal communication skills, including the ability to present findings and risk to executives and non-technical stakeholders.

Preferred Qualifications:

• Experience developing custom tooling, exploits, implants, payloads, or evasion techniques.
• Hands-on experience with commercial and open-source offensive tooling (for example Cobalt Strike, custom C2 frameworks, Burp Suite) and the ability to build or modify tools as needed.
• Programming or scripting proficiency (Python, PowerShell, C/C++, Rust, etc.) sufficient for custom tooling or exploit development.
• Relevant certifications such as OSCP, OSWE, OSCE, GXPN, or equivalent demonstrated expertise.
• Experience working with or managing third-party penetration testing vendors.
• Experience working with development teams on secure SDLC, DevSecOps, or secure code review.
• Knowledge of detection engineering, SIEM/EDR capabilities, or blue team perspectives.
• Prior experience in financial services, insurance, or other regulated environments (for example NYDFS 23 NYCRR 500).
• Prior experience mentoring or leading other security engineers.

What Success Looks Like:

You are the primary owner of offensive security outcomes for Group 1001: delivering a steady, well-scoped penetration testing cadence, running a continuous testing program that reduces real-world risk and improves detection and response, and maintaining a high-quality bug bounty and attack surface management function. Development teams see you as a partner rather than a gate, and leadership gets clear, metrics-driven reporting on risk reduction.

Compensation:

Our compensation reflects the cost of labor across several U.S. geographic markets. The base pay for this position ranges from $200,000/year in our lowest geographic market up to $270,000/year plus bonus in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience.

Benefits Highlights:  

Employees who meet benefit eligibility guidelines and work 30 hours or more weekly, have the ability to enroll in Group 1001’s benefits package. Employees (and their families) are eligible to participate in the Company’s comprehensive health, dental, and vision insurance plan options.  Employees are also eligible for Basic and Supplemental Life Insurance, Short and Long-Term Disability. All employees (regardless of hours worked) have immediate access to the Company’s Employee Assistance Program and wellness programs—no enrollment is required.  Employees may also participate in the Company’s 401K plan, with matching contributions by the Company.

Group 1001, and its affiliated companies, is strongly committed to providing a supportive work environment where employee differences are valued. Diversity is an essential ingredient in making Group 1001 a welcoming place to work and is fundamental in building a high-performance team. Diversity embodies all the differences that make us unique individuals.  All employees share the responsibility for maintaining a workplace culture of dignity, respect, understanding and appreciation of individual and group differences.