Staff Offensive Security Engineer

You are not a vulnerability scanner; you are a strategic adversary. Your directive is to compromise our most critical assets before actual adversaries do.

• Absolute Autonomy: There is no daily task list. You are handed the Rules of Engagement. From there, it is on you to design, dictate, and execute campaigns that provide uncompromising coverage of our attack surface, backed by thorough, rigorous test cases.
• Beyond the Tooling: Off-the-shelf scanners will not find what you are looking for here. We need you for the complex logical flaws and chained vectors that require human intuition. Furthermore, you aren’t just using tools - you are building them. You will engineer complex, future-forward offensive systems that redefine how we test our own defenses at scale.
• Ruthless Prioritization: You have an infinite attack surface and finite time. You must be able to cut through the noise and prioritize your targets based on catastrophic business risk rather than easy, low-impact wins.
• Business Subversion: You do not operate in a vacuum. You will partner directly with product and engineering leaders to deeply understand the core business logic of our platforms - and then weaponize that logic against them.
• Force Multiplier: Breaking in is only half the mandate. When the operation concludes, you teach. You will deconstruct your attack paths and help engineering eradicate entire attack classifications at the root. By driving foundational system hardening and secure development standards, you ensure whole categories of vulnerabilities never see production again.
• Ubiquitous Ownership: Despite the advanced mandate, our ultimate bottom line is protecting our customers, which means finding flaws early across every single part of the business. You will cross business units to provide hands-on security guidance, rigorous architecture review, and audit support. One day you might be red-teaming a physical system, and the next you are tearing apart our flagship product. We demand apex-level hacking, but we have zero tolerance for a “that’s not my job” mentality., We offer flexible work arrangements and the ability to work remotely as needed. Cloaked provides a home office stipend in addition to a new company laptop (and other tech depending on the role).

• Non-Linear Background: You have seen the tech stack from every angle. We value a diverse background - whether you’ve spent time in customer support, QA/test, development, blue team, red team, or all of the above. You know how users break things accidentally, which fuels how you break them intentionally.
• Cloud & SaaS Mastery: Your playground is modern infrastructure. You are fluent in multi-cloud environments and complex SaaS architectures. You know exactly how to abuse IAM trust boundaries, tenant isolation flaws, and API misconfigurations.
• No Ego: You have the communication skills to translate a highly complex exploit into actionable engineering requirements without talking down to the engineers who built it.

Work from home stipend, 401(k), Paid time off, Vision insurance, Dental insurance, Meals & incidentals stipend, Gym membership Full-time Remote in New York, NY, We offer above market rate pay and equity based off of the market’s best commercially available data. Your compensation will be a combination of salary, bonus and equity.

Cloaked employees have 401K, as well as top of the line Health, Dental, and Vision benefits.

Cloaked is a well-funded Series B startup based out of NYC.

Although we are a distributed team, the NYC team operates with a hybrid model. The office building is home to several amenities, including a gourmet cafe, cocktail bar, and a rooftop work area.

We have a fully built out kitchen packed with drinks and snacks. The Cloaked team has diverse interests and so we frequently embark on team outings and go out for socials!