Senior Penetration Tester (AWS)

As a Senior Penetration Tester at Offchain, you will emulate real-world tactics, techniques, and procedures of sophisticated adversaries to surface vulnerabilities across the infrastructure and ecosystem tools that power the Arbitrum stack. You'll conduct hands-on penetration tests, lead red team exercises, and work alongside blue team partners to test, refine, and strengthen detection and response capabilities. Your efforts will directly shape how Offchain designs, launches, and protects the infrastructure powering millions of users and applications, including compliance standards such as SOC 2.

What you'll do

• Conduct comprehensive code audits across a variety of internal applications and infrastructure
• Conduct comprehensive penetration tests across AWS environments, infrastructure, and backend applications
• Collaborate with detection engineering, threat intelligence, and incident response teams to review security controls, uncover coverage gaps, and enhance detection quality
• Build, maintain, and evolve custom offensive tools, scripts, and automation frameworks to increase assessment speed
• Provide offensive security expertise during incident investigations, including log analysis and root cause reviews
• Stay current with evolving threats, vulnerabilities, and attack methods; share research internally and engage with the wider security community
• Own offensive security projects end to end, mentor junior team members, and cultivate a culture of ongoing learning and knowledge exchange

What you bring

• 5+ years of experience in offensive security, penetration testing, red teaming, or a closely related field
• Extensive experience conducting code audits to identify and remediate security issues
• Experience with binary exploitation
• Mastery of AWS and specific attack techniques and configuration weaknesses
• Strong understanding of adversary tactics and frameworks such as MITRE ATT&CK
• In-depth knowledge of web application security, including OWASP Top 10, ASVS, and common vulnerability categories
• Proficiency with offensive security tools such as Burp Suite, nuclei, and similar frameworks
• Strong programming skills in Python, Go, or similar languages, with proven experience developing tools and automation
• Excellent written and verbal communication skills, with the ability to present complex technical details as clear, risk-focused recommendations
• A natural ability to think like an attacker - creative, determined, and skilled at assessing risk across complex systems

Nice to have

• Web3 and blockchain security exposure, such as smart contract auditing, bug bounty hunting (e.g., Immunefi, Code4rena), or DeFi protocol review
• Familiarity with Ethereum L1 and L2 node architecture and security risks
• Experience in blockchain infrastructure penetration testing

What we offer

• Remote-first global workforce with an office in New York
• Professional reimbursement program covering industry conference attendance, certifications, and more
• Medical, dental, and vision coverage (US and select other countries)
• 401k retirement plan with company match (US only)
• Wellness stipend
• Home office setup and ergonomic equipment program

About Offchain

Offchain is a pioneer in blockchain scalability and security, building the Arbitrum stack that powers Arbitrum One, the most widely adopted Ethereum scaling solution. Backed by $124 million in funding, Offchain has demonstrated consistent execution with billions in secured value, thousands of supported projects, and infrastructure processing millions of transactions. Major players including Robinhood, BlackRock, Ethena Labs, Securitize, Aave, and Apechain all use the Arbitrum stack.