> Markdown version of [/jobs/ext/4177357-senior-offensive-security-engineer](https://www.wearedevelopers.com/jobs/ext/4177357-senior-offensive-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Offensive Security Engineer - **Company:** Unity Technologies - **Location:** Mountain View, CA, United States - **Experience:** Expert - **Salary:** $160,300.0 - $305,400.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Application Testing, Microsoft Azure, C++ (Programming Language), Cloud Computing, Cyber Security, Computer Programming, Continuous Integration, Information Leak Prevention, Programming Tools, Python (Programming Language), Open Source Technology, Red Team (Cyber Security), Reverse Engineering, Web Applications, Google Cloud, Cloud Platform System, Large Language Models, Software Security, Multi-Cloud, Agentic-AI, Kubernetes, Build Tools, Purple Team (Cyber Security), Vulnerability Analysis - **Published:** October 29, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=8d8617a62e34aae5 ## About the Role * 6+ years in offensive security (red teaming, penetration testing, purple teaming, or vulnerability research), including leading engagements end to end. * Hands-on experience attacking cloud environments (GCP, AWS, or Azure), including identity, Kubernetes and containers, and CI/CD. * Strong web application and API security testing skills, with the ability to find logic flaws, not just scanner results. * Solid scripting or programming ability (for example Python, Go, or C/C++) to build tools and exploits. * Experience running adversary emulation or red team operations against realistic objectives, and working with defenders in purple team exercises. * Clear written and verbal communication. You can explain technical risk to engineers and to non-technical leaders. * You genuinely enjoy working as part of a team, sharing ideas, offering support, and celebrating wins together., * Experience testing LLM-based products, AI agents, or AI-assisted developer tools. * Reverse engineering, binary exploitation, or game client and anti-cheat security experience. * Experience in gaming, ad tech, or large developer-facing platforms. * Bug bounty, CVEs, conference talks, published research, or open-source security tooling. * Relevant certifications (OSCP, OSEP, OSWE, CRTO) are useful but will not substitute for a track record., This position requires the incumbent to have a sufficient knowledge of English to have professional verbal and written exchanges in this language since the performance of the duties related to this position requires frequent and regular communication with colleagues and partners located worldwide and whose common language is English. ## Description You will find our weaknesses before someone else does. Unity's attack surface spans the engine and editor that developers build on, the client runtime shipped in games played by billions of people, a broad portfolio of cloud products and services, a large ads and monetization business, our corporate environment, and a fast-growing set of AI-assisted and agentic tools. Your job is to attack all of it the way a real adversary would, and to turn what you find into fixes that stick. This is not a checklist pen-testing role. You will plan and run realistic attack campaigns, chain small weaknesses into real impact, and explain clearly to engineers and leaders what an attacker could actually do and what matters most to fix. You will work closely with Product Security, Infrastructure Security, Security Operations, and engineering teams, and you will help build the tooling and automation that let a small offensive team cover a very large surface. What you will own * Adversary emulation and red teaming: plan and run objective-based red team operations against our cloud, corporate, and production environments, modeled on threats relevant to Unity. Run purple team exercises with Security Operations to test and improve detection and response. * Application testing: deep security testing of Unity products and services, including web applications and APIs, the engine, editor and client runtime, ads and monetization systems, and developer-facing platforms. * Cloud and infrastructure attack paths: find and demonstrate attack paths across multi-cloud environments (GCP, AWS, Azure), Kubernetes and containers, CI/CD pipelines, identity, and secrets. * AI and agentic systems: test LLM integrations, AI-native products, and agent workflows for issues such as prompt injection, data leakage, tool misuse, and excessive permissions. * Findings to fixes: write clear, prioritized findings with realistic impact, work with owning teams on remediation, and retest to confirm fixes. * Offensive tooling and automation: build and maintain tools, scripts, and automation that scale adversarial engineering, testing and turn repeated findings into continuous checks. What success looks like in the first 12 months * A risk-based testing plan across Unity's highest-value targets, agreed with security leadership and the owning engineering teams. * Several end-to-end red team or adversary emulation operations completed, each with clear findings, executive-ready readouts, and tracked remediation. * Measurable improvements in detection from purple team exercises with Security Operations. * Reusable tooling or automation that turns recurring classes of findings into continuous checks.