Offensive Security Engineer (Red Team)

About PlexTrac

PlexTrac is a cybersecurity SaaS platform helping security teams streamline reporting, exposure management, and remediation workflows. Our platform is used by penetration testers, red teams, consultants, enterprises, and managed security providers to operationalize security findings and improve collaboration across technical and executive stakeholders.

We are a remote-first company headquartered in the United States with distributed team members across North America, Europe, and Asia. We are committed to ownership, transparency, practical problem-solving, and building products that customers genuinely rely on.

Why This Role Matters

We build security software that helps companies protect their data. To make our product stronger, we are looking for Offensive Security Engineers (Red Team) who think like attackers. You will find weaknesses before the bad guys do, report what you find clearly, and work with our engineering team to fix it. This is a hands-on role with real influence on how we build and ship securely.

Location: Remote — India only.

Responsibilities

• Plan and execute red team engagements across our cloud infrastructure (AWS/GCP/Azure), internal networks, web applications, and SaaS product
• Simulate realistic attack chains — from initial access through lateral movement, credential harvesting, privilege escalation and data exfiltration — using current threat actor techniques
• Conduct assumed breach scenarios, purple team exercises, and objective-based engagements, not just point-in-time pen tests
• Assess cloud-specific attack surfaces: IAM roles and policies, storage misconfigurations, serverless functions, container workloads, and CI/CD pipelines
• Test Active Directory and hybrid identity environments for common and advanced attack paths
• Perform web and API application testing against our core product, including authentication flaws, authorization bypasses, and business logic vulnerabilities
• Build, customize, and maintain offensive tools, scripts, and C2 infrastructure to support engagements
• Develop and manage red team infrastructure — attack servers, redirectors, phishing platforms, and operational security controls
• Create and maintain repeatable testing methodologies and internal playbooks the team can use and build on
• Evaluate and improve detection coverage by working closely with our blue team — identify what's being caught, what isn't, and why
• Write detailed reports that document attack paths, evidence, business impact, and remediation steps — clearly enough that an engineer can act on them without follow-up questions