Staff Attack Engineer (Cybersecurity)

Location: United States, remote; up to 10% travel may be required.

Base salary: $230,000–$275,000 annually, plus equity in the form of stock options.

Company

hirify.global is a remote cybersecurity product company developing NodeZero, a platform for autonomous penetration testing and security assessment operations.

What you will do

• Research and reproduce high-consequence vulnerabilities across enterprise networks, applications, identity systems, cloud environments, and infrastructure.
• Study attacker tactics, techniques, procedures, and campaigns, including CISA KEVs, CVEs, N-Days, Zero-Days, and emerging attack techniques.
• Convert vulnerability research and attacker behavior into safe, repeatable proof-of-exploit capabilities, attack paths, and automated modules for Rapid Response and NodeZero.
• Demonstrate realistic impact such as privilege escalation, credential access, lateral movement, persistence, and data access without unnecessary disruption.
• Safely retest vulnerabilities and security controls to validate remediation and containment.
• Improve execution speed, reliability, observability, and evidence quality while collaborating with research, product, and engineering teams.

Requirements

• Strong Python and software engineering skills, including experience building, testing, and operating production-quality tooling.
• Solid penetration testing, vulnerability research, and exploit-development fundamentals.
• Hands-on experience with enterprise networks, applications, identity systems, cloud environments, or endpoint security.
• Ability to reproduce vulnerabilities and convert manual techniques into reliable automation.
• Understanding of attack chains, trust boundaries, authentication and authorization, privilege escalation, and lateral movement.
• Strong ownership, judgment, communication, and decision-making skills in ambiguous or time-sensitive situations.

Nice to have

• Experience with CISA KEVs, CVE analysis, N-Day or Zero-Day research, or responsible disclosure.
• Background in incident response, threat hunting, purple teaming, or security operations.
• Experience with AWS, Azure, GCP, Kubernetes, Active Directory, Entra ID, Okta, or hybrid environments.
• Experience with exploit development, reverse engineering, malware analysis, or vulnerability research.
• Security research contributions, CVEs, conference talks, open-source tools, technical publications, CTFs, a relevant bachelor's degree, or OSCP certification.

Culture & Benefits

• Remote work with a collaborative, inclusive culture focused on ownership, respect, and results.
• Health, vision, and dental insurance for employees and families.
• Flexible vacation policy and generous parental leave.
• Career development opportunities in a growing cybersecurity company.
• Equity package for all full-time roles.