Staff Offensive Security Engineer

Robinhood Robinhood · Fintech · Bellevue, WA +1 · Security Division

Robinhood is seeking a Staff Offensive Security Engineer to join their elite Red Team. This role involves planning and executing security assessments across applications, infrastructure, and physical environments, simulating adversary behavior to identify and reduce security risks. The engineer will partner with development and security teams to strengthen defenses, prioritize risk, contribute to remediation, and develop tools to enhance testing capabilities. The position requires extensive experience in red team operations or advanced penetration testing, mentoring skills, and a strong understanding of security fundamentals, common protocols, cloud environments, and defensive tools. The role is based in Menlo Park, CA, with a hybrid in-office expectation.

What you'd actually do

  1. Evangelize the Offensive Security Team’s Findings and Projects with stakeholders throughout the company and collaborate with other teams to create solutions that balance security with other priorities.
  2. Mentor and provide guidance to the members of the Offensive Security team.
  3. Plan and execute red team exercises, including long-term assessments that simulate real-world attack scenarios
  4. Perform threat modeling and penetration testing across applications, infrastructure, and corporate environments
  5. Develop scripts and tools to support and automate security testing activities

Skills

Required

  • 8+ years of experience conducting red team operations or advanced penetration testing
  • Experience mentoring or supporting the development of other security engineers
  • Challenging security assumptions
  • Excellent written and verbal communication skills
  • Ability to communicate findings at many different levels of abstraction
  • Fixing security issues
  • Familiarity with common network protocols and standards such as DNS and TCP/IP
  • Experience with MacOS and Linux
  • Experience leveraging components of a modern software development stack to attack companies, including CI, container orchestration systems (Kubernetes/Docker), cloud providers (AWS, GCP)
  • Experience/knowledge of defensive tools/techniques (IDS/IPS, Packet Capture, Network Analysis, AV, EDR, etc.) and how to evade them
  • Deep understanding of Mitre’s ATT&CK Framework
  • Strong understanding of the security fundamentals of access and identity
  • Comfortable reading / writing python, go, and javascript
  • Ability to research and execute a testing plan to access a new technology or process
  • Demonstrated experience working with a distributed team
  • Proficiency to communicate over a text-based medium (Slack, JIRA Issues, GitHub issues, & Email) and can succinctly document technical details

Nice to have

  • Experience in the Financial Technology domain
  • Experience being a technical lead at other organizations

What the JD emphasized

  • plan and execute security assessments
  • partner closely with engineering and security teams
  • strengthen detection and response capabilities
  • prioritize risk
  • contribute to remediation efforts
  • develop tools and techniques
  • 8+ years of experience conducting red team operations or advanced penetration testing
  • Experience mentoring or supporting the development of other security engineers
  • Passion and demonstrated experience for challenging security assumptions.
  • Excellent written and verbal communication skills
  • ability to communicate your findings at many different levels of abstraction from Engineers to Executives.
  • Passion for fixing security issues and not just identifying security issues.
  • Experience leveraging components of a modern software development stack to attack companies, including CI, container orchestration systems (Kubernetes/Docker), cloud providers (AWS, GCP), etc and be able to give hardening suggestions.
  • Experience/knowledge of defensive tools/techniques (IDS/IPS, Packet Capture, Network Analysis, AV, EDR, etc.) and how to evade them.
  • Deep understanding of Mitre’s ATT&CK Framework.
  • Strong understanding of the security fundamentals of access and identity.
  • research and execute a testing plan to access a new technology or process.