Senior Offensive Security Engineer (Red Team)

About the role

Toters is an on-demand e-commerce and delivery platform. As a Senior Offensive Security Engineer (L5), you will own complex offensive security initiatives spanning multiple teams, leading advanced penetration testing, red team and assumed-breach exercises against web applications, APIs, mobile apps, cloud infrastructure, identity and payment-adjacent flows. You will also mentor mid-level and junior engineers and influence secure design decisions.

Key responsibilities

• Lead penetration tests and red team / assumed-breach exercises covering web apps, APIs, mobile apps, cloud infrastructure and authentication systems.
• Lead mobile offensive testing on Android and iOS, including runtime protection, tamper resistance, certificate pinning and key/secret shielding with DexProtector or similar RASP tools.
• Perform threat modeling and identify complex attack paths, then deliver assessment reports with risk ratings, business impact and remediation guidance usable in a SOC 2 and PCI DSS context, followed by re-testing of fixes.
• Influence secure architecture with Engineering, DevOps, Product and the Security Engineer track, and develop offensive security methodologies, tools and automation (AI-assisted testing is required).
• Mentor engineers, run offensive code/design reviews, take part in purple team exercises with detection and incident response teams, and contribute to security standards and structured vulnerability disclosure.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity or a related field, or equivalent practical experience.
• 6+ years of hands-on offensive security, penetration testing or red teaming experience.
• Proven ability to lead complex assessments from scoping to reporting and remediation validation.
• Experience mentoring engineers and strong written and verbal English.
• Nice to have: industry certifications (OSCP, OSCE, OSEP, CRTO, PNPT), full-scope red team experience, custom exploit/tool development, MITRE ATT&CK knowledge, and fluency in Arabic and English (French a plus).

Required skills

• Web, API and mobile security testing (Android and iOS)
• DexProtector or similar mobile shielding / RASP tooling
• Burp Suite, Metasploit, Cobalt Strike or equivalent adversary-emulation platforms
• Python and Bash scripting
• Cloud security testing (AWS preferred)
• SOC 2 and PCI DSS awareness; threat modeling

What we offer

• Competitive compensation package
• Discounts on Toters orders
• First-class medical insurance