3+ years in offensive security, red teaming, or penetration testing with real engagements against production-scale environments.
Strong programming skills in Python; capable of writing custom tools.
Hands-on experience building LLM-powered workflows or agents, beyond basic prompting.
Deep knowledge in at least two areas: cloud security, IAM abuse, Kubernetes, web/API exploitation, CI/CD, or supply chain attacks.
Working knowledge of AI-specific risks like prompt injection and data leakage.
Sound judgment on scope and safety in testing production-adjacent systems.
Clear written communication skills for technical and executive audiences.
Responsibilities
Plan and execute authorized red team operations across various environments including cloud and internal applications.
Build and maintain AI-assisted testing harnesses for vulnerability research and exploit validation.
Utilize LLMs and agentic tools to enhance vulnerability research and reporting processes.
Conduct red team assessments on AI systems to identify security weaknesses.
Emulate realistic adversaries using frameworks like MITRE ATT&CK to create comprehensive attack paths.
Facilitate purple team exercises to improve detection engineering and incident response.
Document findings clearly, track remediation efforts, and automate regression tests for ongoing security.
Benefits
Generous holiday and time off policy.
Health insurance options including medical, dental, and vision.
Work from home support with allowances for home office setup and monthly cell phone/internet costs.
Care benefits including wellness allowances, childcare support, and family planning assistance.
Retirement options with a 401k offering and employer match.
Monthly allowance for using the app to enhance product understanding.
16 weeks of paid parental leave with a gradual return to work.
Full Job Description
Role
Plan and run authorized red team operations across cloud (AWS), Kubernetes, networks, identity systems, SaaS, and internal applications, under written rules of engagement.
Build and maintain AI-assisted testing harnesses: agent loops that run recon, attack-path discovery, fuzzing, and exploit validation with logging, scoping controls, and human approval gates.
Use LLMs and agentic tools to speed up vulnerability research, payload and test-case generation, code review, and report drafting, and measure where they help and where they mislead.
Red team our own AI systems: prompt injection, tool and connector abuse, data exfiltration, model and agent permission boundaries, and supply chain risk in AI dependencies.
Emulate realistic adversaries using MITRE ATT&CK and ATLAS, chaining findings into end-to-end attack paths rather than isolated bugs.
Run purple team exercises with detection engineering and incident response, and tune detections based on what your tests evade.
Write clear findings with reproduction steps, impact, and recommended fixes; track remediation to closure and retest.
Automate regression tests so fixed weaknesses stay fixed, and feed results into CI/CD pipelines.
Document and share techniques, tooling, and lessons learned with engineering teams.
Work collaboratively with Whatnot's Blue Team on Purple Team engagements to help strengthen Whatnot's overall security posture.
You
Curious about who thrives at Whatnot? We've found that low ego, a growth mindset, and leaning into action and high impact goes a long way here.
As our next Red Team Engineer you'll find weaknesses in our infrastructure before real attackers do. You will use AI tools and agents to scale offensive testing, build the harnesses that run it, and turn findings into fixes across cloud, network, application, identity and CI/CD layers.
3+ years in offensive security, red teaming, or penetration testing, with real engagements against production-scale environments.
Strong programming skills in Python; you write your own tooling instead of only running others.
Hands-on experience building LLM-powered workflows or agents (tool use, orchestration, evaluation, guardrails), not just prompting a chat window.
Deep knowledge of at least two areas: cloud security and IAM abuse, Active Directory or identity attacks, Kubernetes and container escapes, web and API exploitation, CI/CD and supply chain attacks.
Working knowledge of AI-specific risks: prompt injection, insecure tool use, data leakage, excessive agent permissions, and model supply chain issues.
Sound judgment on scope, safety, and blast radius; you know how to test production-adjacent systems without causing outages.
Clear written communication: reports an engineer can act on and an executive can skim.
Benefits
Generous Holiday and Time off Policy
Health Insurance options including Medical, Dental, Vision
Work From Home Support
Home office setup allowance
Monthly allowance for cell phone and internet
Care benefits
Monthly allowance for wellness
Annual allowance towards Childcare
Lifetime benefit for family planning, such as adoption or fertility expenses
Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally
Monthly allowance to dogfood the app
All Whatnauts are expected to develop a deep understanding of our product. We're passionate about building the best user experience, and all employees are expected to use Whatnot as both a buyer and a seller as part of their job (our dogfooding budget makes this fun and easy!).
Parental Leave
16 weeks of paid parental leave + one month gradual return to work *company leave allowances run concurrently with country leave requirements which take precedence.
Please note: Whatnot will only contact you through official [redacted].com email addresses. If you see an email impersonating a Whatnot recruiter, please disregard and report it as spam.
