Cybersecurity Engineer (Offensive Security & Governance)

About the role

Plutus21 is looking for a single security engineer who can be trusted on almost any engagement. The work is primarily offensive: network and application penetration testing, web and PHP exploitation, and adversarial testing of AI and LLM systems. It also covers the defensive and governance side, building controls, writing policies and passing audits. The engineer works across Plutus21 and its clients, and helps build the security pod as demand grows.

Key responsibilities

• Offensive security: full-scope penetration tests (PTES or equivalent), red-team and adversary simulations mapped to MITRE ATT&CK, and social-engineering and phishing assessments
• Web and PHP application testing (Laravel, WordPress, legacy stacks) and API and single-page front-end testing
• AI and LLM red-teaming against the OWASP LLM Top 10, including prompt injection, jailbreaks and data-exfiltration risks
• Application security in the pipeline: threat modeling, secure code review and SAST/DAST and dependency scanning in CI/CD
• Cloud, infrastructure and identity controls (AWS preferred), with MFA and periodic access reviews, and cloud security posture management
• Security operations: monitoring, alert triage, detection, response and post-incident review, using SIEM, EDR and vulnerability scanners
• Governance: security policies, SOC 2, ISO 27001 and NIST CSF compliance, vendor assessments and client reporting
• First 90 days: internal pentest, tooling baseline, one client engagement end to end, and the first security policy set and SOC 2 control map

Required profile

• At least five years of hands-on cybersecurity, with offensive work (penetration testing or red-teaming) as a core part of the job
• Proven web application testing track record, including PHP-heavy stacks
• Working knowledge of AI and LLM attack surfaces, or ability to learn quickly
• Strong knowledge of at least one cloud platform (AWS preferred) and practical incident response with SIEM and EDR
• Networking, operating systems, identity management and encryption; scripting in Python, Bash or PowerShell
• Experience with at least one compliance framework (SOC 2, ISO 27001 or NIST CSF)
• Nice to have: OSCP, OSWE, OSEP, CRTP, CISSP, CEH, bug bounty results, Burp Suite fluency, and multi-cloud or consulting experience