Senior Security Engineer

About the role

Toters is seeking a Senior Offensive Security Engineer to own complex offensive security initiatives across multiple product teams. You will lead advanced penetration testing, red‑team exercises, and adversarial simulations to uncover systemic weaknesses in web applications, APIs, mobile apps, cloud infrastructure, identity, and payment‑related flows.

Key responsibilities

• Lead comprehensive penetration tests and red‑team/assumed‑breach exercises targeting web, API, mobile, cloud, and authentication systems.
• Perform mobile offensive testing on Android and iOS, including runtime protection bypass, certificate pinning validation, and key/secret shielding using tools such as DexProtector and MobSF.
• Conduct in‑depth threat modeling to identify complex attack paths across services, trust boundaries, and tenant isolation.
• Produce high‑quality security assessment reports with risk ratings, business impact analysis, and remediation guidance for SOC 2 and PCI DSS compliance, then re‑test fixes.
• Collaborate with engineering, DevOps, product, and security teams to influence secure architecture and address root‑cause vulnerabilities.
• Develop and automate offensive security methodologies, including AI‑assisted testing.
• Mentor mid‑level and junior offensive engineers and lead purple‑team exercises with detection and incident‑response teams.

Required profile

• 5+ years of hands‑on offensive security experience in a fast‑paced technology environment.
• Proven track record leading penetration testing and red‑team engagements for large‑scale web, mobile, and cloud platforms.
• Strong ability to communicate technical findings to engineering and audit stakeholders.
• Passion for staying at the forefront of offensive security research and emerging threats.

Required skills

• Penetration testing (web, API, mobile, cloud)
• Red‑team / assumed‑breach exercises
• Threat modeling and attack‑path analysis
• Mobile security tools (Android, iOS, DexProtector, MobSF)
• Certificate pinning, Certificate Transparency, runtime protection bypass
• Identity and access management security
• Payment‑flow security
• SOC 2 and PCI DSS compliance knowledge
• AI‑assisted testing and security automation