Senior Offensive Security Engineer

Summary

Join HubSpot's Threats and Vulnerabilities team and contribute to protecting our customers by systematically reducing HubSpot’s attack surface and improving the maturity of HubSpot’s Product Security. This team maps out HubSpot’s defenses, identifies and prioritizes improvements based on threat intelligence, and tests applications and infrastructure to find and fix weaknesses. As an experienced engineer, you will continuously measure HubSpot’s application security defenses, provide security recommendations, participate in red team exercises, and maintain knowledge of the latest vulnerabilities. You will also manage bug bounty programs, act as an escalation point for security incidents, conduct research on campaigns and actors, and drive projects to improve HubSpot’s Security and Privacy controls. The role requires 5+ years of experience in application security, threat intelligence, or incident response, along with experience in red teaming and penetration testing. HubSpot values flexibility and offers both remote and in-office work options, with some in-person events required.

Requirements

• 5 or more years experience in application security, threat Intelligence or incident response
• Previous involvement in red teaming, adversary emulation, or penetration testing
• Experience working with at least one programming language (Java, C#, Python etc)
• Understanding of secure development practices, public cloud, and network security
• Familiarity with security monitoring tools and investigation tools such as Splunk and Kibana
• Ability to communicate information about security and risk to a diverse audience

Responsibilities

• Continuously measure HubSpot’s application security defences, highlighting areas of strength and weakness
• Provide security-focused recommendations based on threat intelligence and vulnerability assessments
• Participate in red team exercises to find weaknesses in HubSpot’s products and tools
• Maintain knowledge of the latest vulnerabilities, exploits, and the evolving threat landscape and distil that knowledge to other groups within HubSpot
• Manage programs for bug bounty and internal and external penetration testing, ensuring vulnerabilities are identified and mitigated
• Act as an escalation point for security incidents that require the specialized knowledge of this team
• Conduct research on campaigns and actors through technical analysis of data
• Drive projects and improvements that improve HubSpot’s Security and Privacy controls within the Product Organization and beyond

Benefits

• Remote work, flexible hours
• In-person onboarding required for full-time Engineering roles
• In-person events such as HubSpot’s annual PEER week, Product Group Summit, and other in-person gatherings