Senior Security Engineer, Offensive Security & Remediation

Senior Security Engineer focused on offensive testing, remediation, and security guardrails across web, API, and AWS infrastructure.

Responsibilities

• Plan and execute red team, purple team, and application penetration tests mapped to MITRE ATT&CK, targeting threats relevant to a consumer health company, including account takeover, API abuse, cloud credential misuse, and data exfiltration.
• Test TypeScript web apps and APIs against OWASP Top 10 and API Top 10, with focus on broken authorization and IDOR, injection, SSRF, prototype pollution, XSS, and insecure deserialization.
• Continuously test features as they ship in production using agreed rules of engagement, including dedicated test accounts, no access to real member data, rate limits, and defined stop conditions.
• Attack and validate protections in the identity stack including OIDC/OAuth, SSO, and session handling.
• Build and run agentic red team workflows using LLM-driven agents for recon, attack-path discovery, and continuous testing under human oversight, with scoped targets, kill switches, audit logging, and human approval before high-impact actions.
• Evaluate AI capabilities by testing for prompt injection, tool misuse, and data leakage.
• Scope, manage, and quality-check third-party pentest and red team engagements, covering rules of engagement through retest.
• Scope and ship remediation PRs in TypeScript/Node.js and React/Next.js, including tests and following team review and release processes.
• Fix vulnerable npm dependencies safely by handling upgrades, lockfile hygiene, and breaking changes.
• Develop secure-by-default libraries and patterns (authorization middleware, input validation schemas, safe output encoding, secrets handling) for adoption by product teams.
• Convert recurring finding classes into durable guardrails via regression tests, custom SAST or lint rules, or CI checks.
• Use AI coding assistants and agents to speed up remediation, with human review on every change.
• Emulate cloud attacks across AWS accounts, including IAM privilege escalation, role-chaining, cross-account trust abuse, and exposed credentials / IMDS abuse via SSRF.
• Test external exposure including public S3 buckets, API Gateway and Lambda misconfigurations, CloudFront, load balancer edge cases, and forgotten internet-facing assets.
• Assess EKS and Kubernetes for container escape, pod-to-cloud privilege paths, and secrets exposure.
• Map application attack paths to cloud impact and coordinate infrastructure fixes with platform owners using clear reproduction steps.
• Partner with the broader product security team to share priorities, findings, and participate in triage.
• Help run and tune security tooling including SAST, DAST, and SCA by reducing false positives and routing valid issues to owners.
• Triage and validate Bugcrowd submissions: reproduce reports, set severity, and collaborate on engineering fixes and payouts.
• Use and improve Claude Security to discover and patch vulnerabilities, validating findings and fixes with manual testing.
• Report outcomes including exploitable findings closed, time to remediate vs SLA, eliminated bug classes, and tooling signal-to-noise.

Requirements

• 6+ years in security or software engineering, with 3+ years hands-on offensive experience (pentesting, red or purple team, or application security testing).
• Hands-on offensive experience in AWS: IAM privilege escalation, cross-account and role-trust abuse, SSRF to metadata credentials, and misconfigured public services.
• Production engineering experience in TypeScript and Node.js, including shipped fixes that went through code review, tests, and CI/CD.
• Deep understanding of web and API vulnerabilities across OWASP Top 10 and API Security Top 10, including correct remediation in code.
• Experience safely testing live production systems under rules of engagement.
• Working experience with SAST, DAST, and SCA tools, including tuning and triage of outputs.
• Hands-on experience with or building agentic offensive workflows, with awareness of where they fail.
• Experience with Burp Suite or similar proxies, plus scripting custom tooling in TypeScript or Python.
• Solid knowledge of OAuth 2.0 and OIDC, including session management and authorization models.
• Clear writing that enables engineers to act on findings and produces PR descriptions reviewers can trust.

Technologies

• TypeScript, Node.js, React/Next.js
• MITRE ATT&CK, OWASP Top 10, API Top 10
• OIDC/OAuth, SSO
• SAST, DAST, SCA
• Bugcrowd
• Claude Security, LLM-driven agents
• Burp Suite
• Amazon Web Services (AWS), IAM, SSRF, SS3, IMDS
• API Gateway, Lambda, CloudFront, Load balancer
• EKS, Kubernetes
• npm, Semgrep, ESLint
• CloudFox, Prowler, Pacu
• Atomic Red Team, Caldera
• MCP servers
• Tool-calling LLM APIs
• OWASP Top 10 for LLM Applications, MITRE ATLAS
• SBOMs
• SOC 2, HITRUST, CCPA

Nice to Have

• React/Next.js and a Node.js framework such as NestJS or Express.
• npm supply chain security exposure, including SBOMs, provenance, lockfile and install-script risks.
• Experience writing custom SAST rules (Semgrep-style) or ESLint security rules.
• Experience managing third-party pentest or red team vendors end to end.
• Agent frameworks, MCP servers, or tool-calling LLM APIs; knowledge of OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Adversary-emulation tooling (e.g., Atomic Red Team, Caldera) and C2 frameworks.
• Experience running or triaging a bug bounty program (Bugcrowd or similar), or a personal bug bounty track record or published CVEs; cloud offensive tooling such as Pacu, CloudFox, or Prowler; AWS certifications (e.g., AWS Security Specialty).
• Experience in regulated environments (HITRUST, SOC 2, CCPA).

Recruitment Security & Fraud Prevention

• All official correspondence from the recruiting team originates from an @ww.com email address.
• Hiring requires live interaction; interviews and employment offers are not conducted solely through text message, chat apps, or automated email-only exchanges.
• WeightWatchers does not ask candidates for any form of payment.
• No checks will be sent with instructions to purchase equipment or “start-up kits.”
• Sensitive personal information is requested only through an official, secure onboarding portal after a formal offer, not during the interview phase.
• If contacted by someone claiming to represent WeightWatchers and the process differs from these standards, do not share personal information.
• Verify open positions via the official careers page: https://job-boards.greenhouse.io/ww.

Location: New York, NY (hybrid)
Salary: USD 180,000 - 195,000 per year
Minimum experience: 3 years