Senior Pentest Operations Specialist

About Strike

Strike is an offensive security company that runs a hybrid AI + human penetration testing model at scale. Our AI Hacking Agents autonomously execute threat emulations against client assets, while a curated community of specialized hackers (Strikers) and an internal Hacking Team ensure quality, coverage, and depth that no single approach delivers alone.

We work with companies across the globe, from fast-growing fintechs to large banks and enterprise clients, delivering elite offensive security with continuous hybrid validation through our platform.

Position Overview

The Hacking Team is split into two subteams. Offensive Research pushes the technical frontier of our AI Agents. Hacking Operations makes sure the hybrid model delivers real offensive value, at scale, with a quality bar we're proud of. This role sits in Hacking Operations.

You're a hacker first. You'll be the senior technical judgment behind the engagements you own: deciding where the AI agent runs, where a Striker should go deeper, and where you step in yourself. You'll own quality, so what reaches the client is real, well evidenced and impactful. You'll see what the agent does well and where it falls short, and that insight shapes how our AI and our team evolve.

You are accountable for the operational health of the engagements assigned to you, and you're expected to drive improvements in how the team operates, not just execute the current playbook.

Key Responsibilities

Day-to-day operations

• Own the end-to-end lifecycle of pentesting engagements: scope validation, Striker assignment, progress tracking, SLA compliance, delivery, and closeout.

• Decide the right mix for each engagement: where the AI agent runs, where Strikers go deeper, and where you jump in yourself.

• Assign Strikers to projects based on expertise, availability, tier, and asset type. Track their performance, hold the quality bar, and flag issues early.

• Perform config reviews on incoming pentests to validate scope, access, credentials, and testing conditions before execution starts.

• Monitor engagement health: aging projects, blocked pentests, missing deliverables, SLA breaches. Escalate proactively.

• Hands-on hacking: validate and chain findings, escalate impact on critical vulnerabilities, jump into PoCs, and hack alongside the team when depth or speed demands it, across web, APIs, mobile, and infrastructure.

Vulnerability triage

• Triage AI Agent-reported vulnerabilities where human judgment matters: validate severity and impact, flag false positives, and ensure evidence quality meets the bar.

• Triage Striker-reported vulnerabilities when needed: review CVSS scoring, evidence, reproducibility, and remediation guidance.

• Provide structured feedback to the AI and Product teams on agent behavior patterns, gaps, and recurring failure modes. Every time a human has to step in is a chance to make the agent better.

Sales and client support

• Support the proposals pipeline with technical scoping: review incoming requests, validate feasibility, recommend effort and approach.

• Attend client meetings to provide technical context on findings, align on scope, or address escalations.

• Collaborate with Customer Success to ensure client expectations match engagement reality.

Process and tooling

• Keep engagement data and operational tracking accurate across our platform and internal tools.

• Identify bottlenecks, manual steps, and repeated friction points. Propose and help implement process improvements.

• Coordinate with Product and Tech on platform feature requests and operational tooling needs.

Requirements

Must-have:

• 5+ years of experience in offensive security, penetration testing, and cybersecurity operations.

• Solid understanding of vulnerability classes across web, APIs, mobile, and infrastructure, CVSS scoring, exploitation techniques, and pentesting methodologies (OWASP, OSSTMM, PTES, or equivalent).

• Experience managing or coordinating security engagements: scoping, resource allocation, client communication, delivery tracking.

• Fluent Spanish and advanced English, written and spoken. English is the daily working language for Striker communication, client meetings, and documentation.

• Ability to handle multiple engagements in parallel without dropping quality or deadlines.

• Strong problem-solving skills and ability to handle escalations efficiently. Attention to detail and ability to work independently.

• Comfort working with operational tools: ticketing systems, dashboards, and internal admin portals.

Nice-to-have:

• A visible track record: CVEs, bug bounty results, published research, talks, or CTFs.

• Certifications: OSWE, OSCP, BSCP, eWPT, eWAPTXv2, or similar offensive security certs.

• Experience in a PTaaS, bug bounty platform, or managed security services environment.

• Familiarity with AI-assisted security testing or automated vulnerability scanning at scale.

• Background in process improvement, operational automation, or security program management.

• Portuguese.

What this role is NOT

To set expectations clearly:

• This is not a dedicated research position. We have a separate Offensive Research team focused on pushing the AI Agents' technical frontier. You'll collaborate closely with them, and as you grow you'll have room to bring research work into your role, but your primary mission is operational excellence.

• This is not IT support or network administration. The role is about running pentest operations at scale, not managing infrastructure.

Why Strike

• You'll work at the intersection of AI and offensive security, one of the fastest-moving spaces in cybersecurity. Our AI Agents are not a roadmap item; they run in production, on real client assets, every day.

• You'll collaborate with an elite Hacking Team where your judgment directly impacts client outcomes and product evolution.

• You'll have real influence over how we scale operations. Process decisions here are not theoretical; they ship.

• Room to build your career: grow into Offensive Research work and into leading Hacking Operations as the team scales.

• Remote-first, async-friendly culture. Flexible schedule, paid time off.

• Conference sponsorship and access to training resources (DEF CON, Ekoparty, Black Hat, HTB, etc.).

• Competitive compensation (USD, contractor).