Senior Offensive Security Engineer
Description
About Us:
At Sitecore, our mission is to simplify how brands reach, engage, and serve people by delivering intelligent, personalized digital experiences that connect the world. We empower the world’s most iconic brands to build lifelong relationships with their customers—seamlessly, smartly, and at scale.
As the leading provider of agentic digital experience software, Sitecore brings together content, commerce, and data into one composable platform that enables brands to deliver millions of meaningful, adaptive experiences every day. Trusted by global leaders such as American Express, Porsche, Starbucks, and L’Oréal, Sitecore helps brands transform engagement through experiences that are not only personalised but predictive and dynamic.
Our foundation is our people—a diverse, passionate, and collaborative global team spanning over 25 countries. We believe that every experience matters, and that belief starts with how we work together. Our values guide how we lead, innovate, and connect. They are the behaviors that bring our mission and vision to life, every day, in every interaction.
As we continue to evolve, we are actively cultivating AI skills across our teams to unlock new levels of creativity, efficiency, and insight. From engineering to customer experience, AI capabilities are becoming integral to how we design, build, and deliver the next generation of digital experiences.
Learn more at Sitecore.com.
About the Role:
We are seeking a Senior Offensive Security Engineer to help strengthen our security posture by proactively identifying and addressing vulnerabilities across our environment. This role focuses on internal penetration testing, vulnerability management, risk analysis, and supporting our Bug Bounty program to ensure issues are remediated effectively and securely. You will collaborate with multiple technical teams to drive remediation and provide expert guidance where needed.
What You’ll Do:
- Plan and execute internal penetration tests across systems and applications; document findings clearly and provide actionable recommendations
- Perform vulnerability assessments, validate reported issues, and prioritize based on risk and severity.
- Coordinate and track remediation efforts with internal teams, ensuring timely closure of identified risks.
- Conduct re‑testing of resolved findings to confirm proper remediation.
- Provide consultative support to technical teams on security best practices and mitigation strategies.
- Prepare concise reports and communicate risk posture to stakeholders in a clear, business‑aligned manner.
- Participate in Bug Bounty program operations: review submissions, validate findings, and coordinate remediation with internal teams.
- Participate in coordinated red-blue team exercises to simulate real-world attack scenarios, develop and execute adversary tactics, detect and respond to threats in real time, and synthesize findings into actionable remediation and control improvements.
What You Need to Succeed:
- Strong background in penetration testing with practical experience in exploitation techniques and vulnerability analysis.
- Familiarity with common penetration testing tools and methodologies including (Burp, Kali, MITRE ATT&CK)
- Proven expertise in comprehensive full-stack testing, encompassing infrastructure and beyond.
- Solid understanding of vulnerability management processes and risk prioritization.
- Ability to communicate technical findings effectively to both technical and non‑technical audiences.
- Proven track record of driving remediation efforts across diverse teams.
Additional Skills That Could Set You Apart:
- Experience in testing and evaluating AI systems.
- Familiarity with enterprise environments (cloud, identity, network).
- Experience working with Bug Bounty programs or vulnerability disclosure processes.
- Relevant certifications (e.g., OSCP, CRTO, GPEN) are a plus
Why Join Us?
You’ll be part of a team that values proactive security, collaboration, and continuous improvement. This is an opportunity to make a tangible impact on enterprise resilience while working on challenging and meaningful projects, including helping to innovate how we test and protect AI systems—both for our internal use cases and across our AI-powered products.
How we hire
At Sitecore, we put a lot of care and time into who we hire. We believe that in order to build the best products, we need to build high impact teams. Our recruitment process centers around what we call the Life Story interview, a conversational-style interview where we get to learn more about you.
Sitecore is proud to be an equal opportunity workplace. We are committed to equal employment opportunity without unlawful regard to race, color, ancestry, religion, gender, national origin, sexual orientation, age, citizenship, marital status, disability, veteran status or any other local legally protected characteristic.