← All roles

Staff Attack Engineer, Internal/AD

Horizon3 AI· Engineering
Apply on company site
Remote$235k - $275kFull-timePosted 1mo ago

About the role

Staff-level technical lead for internal network and Active Directory attack capabilities in NodeZero, Horizon3’s autonomous pentesting platform. Focus on turning cutting-edge AD/internal attack techniques into safe, reliable, production-grade content and attacks that run autonomously across large enterprise environments.

Responsibilities

  • Serve as the technical lead and primary subject matter expert for internal-network and Active Directory attack capabilities across NodeZero.
  • Research emerging AD and internal tradecraft (AD Certificate Services abuse, SCCM/ConfigMgr and other management-plane attacks, Kerberos abuse and delegation including RBCD, NTLM and Kerberos coercion and relay, shadow credentials, ACL and GPO abuse, and hybrid identity pivots) and turn it into production attack content.
  • Design, build, and maintain production-grade Python that powers these capabilities safely and at enterprise scale.
  • Focus on modern, hardened environments (NTLM deprecation and SMB signing by default, Kerberos-only, Protected Users and tiered admin, LAPS and gMSA/dMSA) and build attacks that still succeed when the easy paths are closed.
  • Stand up, configure, and exploit representative AD test environments to validate, demonstrate, and regression-test attack scenarios.
  • Extend our attack-path modeling and graph data model to represent new identity, privilege-escalation, and lateral-movement paths.
  • Set priorities and the coverage roadmap based on real customer environments, threat intelligence, and emerging techniques.
  • Mentor and level up attack engineers, and raise the bar on code quality, research rigor, and operational safety.
  • Collaborate cross-functionally with engineers, product managers, and customer-facing teams, and author internal documentation and external research and blog posts.

Qualifications

  • Deep, hands-on offensive experience against Active Directory and internal enterprise networks, from initial foothold through domain and enterprise compromise.
  • Command of current AD tradecraft: credential access, Kerberos attacks, NTLM coercion and relay, AD Certificate Services abuse, ACL and GPO abuse, and lateral movement and persistence.
  • Demonstrated experience attacking modern, hardened environments (NTLM deprecation and enforced signing, Kerberos-only, tiered administration).
  • Strong software engineering fundamentals with expert-level Python, and a track record of shipping and maintaining production-quality code, not just scripts and proofs of concept.
  • Ability to independently research unfamiliar systems and technologies and rapidly become the team's expert.
  • A track record of technical leadership: setting direction, driving high-complexity and high-risk work, and mentoring other engineers.
  • Strong written and verbal communication, including clear technical documentation.
  • A passion for building products, not just finding vulnerabilities.
  • 8+ years of combined offensive security and/or software engineering experience, with significant time focused on Active Directory and internal network attacks.

Skills

Required:Active Directory attack expertiseAD tradecraftPythonTechnical leadership

Benefits

  • Health, vision & dental insurance for you and your family
  • Flexible vacation policy
  • Generous parental leave
Last updated Oct 8, 2026. Interested? Apply on the company site.

About Horizon3 AI

Only Pentesting Platform Proven in Production

Continuously assess, fix, and verify your security posture. Securing enterprises across many attack surfaces.

PentestingSecurity PostureThreat DetectionVulnerabilitiesRisk AssessmentOffensive Security
Company profileWebsite

More open roles at Horizon3 AI