Senior Security Engineer, Offensive Security & Remediation
WW International · United States - Remote
About this role
## Senior Security Engineer, Offensive Security & Remediation ### About the Team WeightWatchers (WW) helps millions of members build healthier habits through science-backed weight management, clinical care, and community. Protecting members’ health and personal data is core to that trust. Platform Security is shifting from a compliance-driven program to an engineering-driven one—building detection and response, cloud and application security, supply chain security, and identity controls with a small team that ships real capabilities. ### What You’ll Do You’ll spend most of your time **breaking things** through continuous offensive testing across TypeScript applications, APIs, and AWS infrastructure—especially as new features ship to production—using both hands-on techniques and AI agent-driven workflows. You’ll also write fixes and help prevent repeat issues. About **one-third** of your time goes to remediation PRs and guardrails that stop bug classes from coming back. As part of the broader product security team, you’ll help run and improve SAST, DAST, SCA, bug bounty, and AI-assisted security tooling. #### Offensive security (~70%) - Plan and run **red team, purple team, and application penetration tests** mapped to **MITRE ATT&CK**, focused on threats that matter to a consumer health company: **account takeover, API abuse, cloud credential misuse, and data exfiltration**. - Test TypeScript web apps and APIs for **OWASP Top 10** and **API Top 10** issues (e.g., broken authorization/IDOR, injection, SSRF, prototype pollution, XSS, insecure deserialization). - Continuously test new production features under agreed **rules of engagement** (dedicated test accounts, no real member data, rate limits, clear stop conditions). - Attack the identity stack (**OIDC/OAuth, SSO, session handling**) to validate controls. - Build and operate **agentic red team workflows** (LLM-driven agents for recon, attack-path discovery, and continuous testing) with human oversight, scoped targets, kill switches, audit logging, and human approval before high-impact actions. - Test WW’s AI features and agents for **prompt injection, tool misuse, and data leakage**. - Scope, manage, and quality-check third-party pentest/red team engagements (rules of engagement through retest). #### Remediation & secure engineering (~30%) - Write and ship remediation PRs in **TypeScript/Node.js** and **React/Next.js** with tests, following review and release processes. - Fix vulnerable **npm dependencies** safely (upgrades, lockfile hygiene, breaking-change handling). - Build secure-by-default libraries and patterns (authorization middleware, input validation schemas, safe output encoding, secrets handling) for product teams to adopt. - Turn each finding class into durable guardrails (regression tests, custom SAST/lint rules, or CI checks). - Use AI coding assistants/agents to speed remediation—with **human review on every change**. #### AWS infrastructure offensive security (stretch) - Emulate cloud attacks across AWS accounts: **IAM privilege escalation, role-chaining/cross-account trust abuse**, exposed credentials, and **IMDS abuse via SSRF**. - Test external exposure: public S3 buckets, API Gateway/Lambda misconfigurations, CloudFront/load balancer edge cases, and forgotten internet-facing assets. - Assess **EKS/Kubernetes** for container escape, pod-to-cloud privilege paths, and secrets exposure. - Map application bugs to cloud impact and hand infrastructure fixes to pl
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.