Senior Security Engineer (Offensive & Application Security)

About the role

This is a one-person security function at Plutus21, covering both offensive and defensive work. The engineer runs red-team and penetration testing engagements, then builds the controls, policies and tooling needed to pass audits such as SOC 2. The role works across Plutus21 and its clients, and includes helping to hire the security pod as demand grows.

Key responsibilities

• Offensive security: full-scope penetration tests, red-team and adversary simulations mapped to MITRE ATT&CK, and social-engineering and phishing assessments
• Web and PHP application testing (Laravel, WordPress, REST and GraphQL APIs) and OWASP Top 10 flaws
• AI and LLM red-teaming against the OWASP LLM Top 10, including prompt injection, jailbreaks and data-exfiltration risks
• Secure development practice: threat modeling, secure code review and SAST/DAST and dependency scanning in CI/CD
• Cloud, infrastructure and identity controls (AWS preferred), IAM with MFA and periodic access reviews, and cloud security posture management
• Security operations: monitoring, alert triage, detection, response and post-incident review, with SIEM, EDR and vulnerability scanning
• Governance: security policies, SOC 2, ISO 27001 and NIST CSF compliance, vendor assessments and client reporting
• First 90 days: internal pentest, tooling baseline, one client engagement end to end, and the first security policy set and SOC 2 control map

Required profile

• At least five years of hands-on cybersecurity, with offensive work (penetration testing or red-teaming) as a core part of the job
• Proven web application testing track record, including PHP-heavy stacks
• Working knowledge of AI and LLM attack surfaces, or ability to learn quickly
• Strong working knowledge of at least one cloud platform (AWS preferred) and practical incident response with SIEM and EDR
• Experience with at least one compliance framework (SOC 2, ISO 27001 or NIST CSF)
• Nice to have: OSCP, OSWE, OSEP, CRTP, CISSP, CEH, bug bounty results, Burp Suite fluency, and multi-cloud or consulting experience

Required skills

• OWASP Top 10, PHP (Laravel, WordPress), and API attack classes
• AWS and scripting in Python, Bash or PowerShell
• Networking, operating systems, identity management and encryption
• Excellent written and spoken English