Staff Attack Engineer, Internal/AD
Horizon3 · Remote · US, Remote ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Staff level position
- Fully remote (US)
- Python + Active Directory
- Offensive security focus
- Equity package included
As the technical lead for internal and AD attack domains, you will define the research roadmap and transform manual tradecraft into safe, repeatable autonomous attacks. You will mentor engineers, design production-grade Python modules, and ensure NodeZero stays ahead of hardening trends like NTLM deprecation and tiered administration.
What you'll do
- Serve as primary subject matter expert for internal network and AD attack capabilities
- Research emerging tradecraft including ADCS abuse, SCCM attacks, and Kerberos coercion
- Design and maintain production-grade Python code for enterprise-scale autonomous attacks
- Build attacks that succeed in hardened environments with NTLM deprecation and SMB signing
- Configure and exploit representative AD test environments for validation and regression testing
- Extend attack-path modeling and graph data models for new privilege escalation paths
- Mentor attack engineers and raise standards for code quality and operational safety
- Collaborate with product and engineering teams to set coverage priorities based on threat intel
What you'll need
- 8+ years of combined offensive security and software engineering experience
- Deep hands-on experience attacking Active Directory from foothold to domain compromise
- Expert-level Python skills with a track record of shipping production-quality code
- Command of current AD tradecraft including Kerberos attacks, ACL abuse, and lateral movement
- Experience attacking modern hardened environments with tiered administration and LAPS
- Proven ability to independently research unfamiliar systems and become a team expert
- Strong technical leadership skills with experience mentoring other engineers
- Excellent written and verbal communication skills for documentation and collaboration
Nice to have
- OSCP, OSEP, CRTO, or equivalent offensive security certifications
- Experience with SCCM, Windows Admin Center, and management-plane attack surfaces
- Knowledge of hybrid identity attacks involving Entra ID and primary refresh tokens
- Contributions to offensive tooling such as BloodHound, Impacket, or netexec
- Familiarity with graph databases like Neo4j and attack-path analysis
- Public contributions via open-source tools, blog posts, conference talks, or CVEs
Stack
- Python
- Active Directory
- Neo4j
- BloodHound
- Impacket
- netexec
How you'll work
- Fully remote position with up to 10% travel required
- Based in US time zones preferred
- Occasional presence at Chicago office may be required depending on role
What you get
- Base salary range $235,000 - $275,000 USD
- Equity package in the form of stock options
- Health, vision, and dental insurance for employee and family
- Flexible vacation policy
- Generous parental leave
- Inclusive culture with diversity and growth opportunities