Staff Attack Engineer, Internal/AD

Get to Know Us Horizon3 is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find and fix and verify exploitable attack vectors before criminals exploit them. Our flagship product, the NodeZeroTM platform, delivers production-safe autonomous pentests and other key assessment operations that scale across the largest internal, external, cloud, and hybrid cloud environments. NodeZero has been adopted by organizations of all sizes, from small educational institutions to government agencies and Global 100 enterprises. It is used by ITOps/SecOps teams, consulting pentesters, and MSSPs and MSPs. We are a fusion of former U.S. Special Operations cyber operators, startup engineers, and formerly frustrated cybersecurity practitioners. We're committed to helping solve our common security problems: ineffective security tools, false positives resulting in alert fatigue, blind spots, "checkbox” security culture, cybersecurity skills shortage, and the long lead time and expense of hiring outside consultants. Collectively, we are a team of learn it alls, committed to a culture of respect, collaboration, ownership, and results. What You’ll Do We're looking for a Staff Attack Engineer to be the technical lead for internal network and Active Directory attack capabilities in NodeZero, our autonomous pentesting platform. Active Directory is still the beating heart of most enterprise breaches, and it is exactly where our customers most need NodeZero to find and safely prove the exploitable paths that lead to domain and enterprise compromise. This is a highly strategic role. The environments we operate in are hardening fast (NTLM deprecation, SMB signing on by default, Kerberos-only and tiered-admin designs), and at the same time the tradecraft is moving quickly across AD Certificate Services, SCCM and other management planes, delegation abuse, coercion and relay, and hybrid identity. We need someone who lives on that frontier and can keep NodeZero ahead of it. You'll own the technical direction for our internal and AD attack domain: setting the research and content roadmap, acting as the go-to subject matter expert, and raising the bar for the engineers building alongside you. This is not consulting or manual pentesting. The goal is to turn cutting-edge, often manual techniques into safe, reliable, repeatable attacks that run autonomously across the largest internal environments in the world. If you love both breaking Active Directory and building the software that does it, this is the seat. What You’ll Do Serve as the technical lead and primary subject matter expert for internal-network and Active Directory attack capabilities across NodeZero. Research emerging AD and internal tradecraft (AD Certificate Services abuse, SCCM/ConfigMgr and other management-plane attacks, Kerberos abuse and delegation including RBCD, NTLM and Kerberos coercion and relay, shadow credentials, ACL and GPO abuse, and hybrid identity pivots) and turn it into production attack content. Design, build, and maintain production-grade Python that powers these capabilities safely and at enterprise scale. Focus on modern, hardened environments (NTLM deprecation and SMB signing by default, Kerberos-only, Protected Users and tiered admin, LAPS and gMSA/dMSA) and build attacks that still succeed when the easy paths are closed. Stand up, configure, and exploit representative AD test environments to validate, demonstrate, and regression-test attack scenarios. Extend our attack-path modeling and graph data model to represent new identity, privilege-escalation, and lateral-movement paths. Set priorities and the coverage roadmap based on real customer environments, threat intelligence, and emerging techniques. Mentor and level up attack engineers, and raise the bar on code quality, research rigor, and operational safety. Collaborate cross-functionally with engineers, product managers, and customer-facing teams, and author internal documentation and external research and blog posts. What You’ll Bring Required Deep, hands-on offensive experience against Active Directory and internal enterprise networks, from initial foothold through domain and enterprise compromise. Command of current AD tradecraft: credential access, Kerberos attacks, NTLM coercion and relay, AD Certificate Services abuse, ACL and GPO abuse, and lateral movement and persistence. Demonstrated experience attacking modern, hardened environments (NTLM deprecation and enforced signing, Kerberos-only, tiered administration). Strong software engineering fundamentals with expert-level Python, and a track record of shipping and maintaining production-quality code, not just scripts and proofs of concept. Ability to independently research unfamiliar systems and technologies and rapidly become the team's expert. A track record of technical leadership: setting direction, driving high-complexity and high-risk work, and mentoring other engineers. Strong written and verbal communication, including clear technical documentation. A passion for building products, not just finding vulnerabilities. 8+ years of combined offensive security and/or software engineering experience, with significant time focused on Active Directory and internal network attacks. Preferred OSCP (or OSEP, CRTO, or equivalent offensive certifications). Experience with SCCM, Windows Admin Center, and other modern Windows management-plane attack surfaces. Experience with hybrid identity attacks (Entra ID and Entra Connect, primary refresh tokens, seamless SSO) and on-prem to cloud pivots. Experience developing or contributing to offensive tooling like BloodHound, Impacket, netexec, etc. Familiarity with graph databases (Neo4j) and attack-path analysis. Experience integrating security research into production, multi-tenant SaaS. Public contributions to the field: open-source tools, technical blog posts, conference talks, or published CVEs. Experience building production-safe autonomous or automated offensive tooling. Travel Required We are a fully remote company, and this job may require up to 10% of travel to be successful. Perks of Horizon3 Inclusive Team: We value diversity and promote an inclusive culture where everyone can thrive. Growth Opportunities: Be part of a dynamic and growing team with numerous career development opportunities. Innovative Culture: Work in a collaborative environment that encourages creativity and out-of-the-box thinking. Hybrid & Remote Work: We embrace a mix of remote and hybrid work models depending on role and location, including our Chicago office, where some roles require regular in-office presence. Competitive Compensation: We offer competitive salary, equity and benefits. Our benefits include health, vision & dental insurance for you and your family, a flexible vacation policy, and generous parental leave. Compensation and Values At Horizon3, we believe that our people are our greatest asset, and our compensation philosophy reflects this core value. We are committed to fostering an environment where all employees feel valued, respected, and rewarded for their contributions. Our compensation structure is designed to be fair, competitive, and transparent, ensuring that every team member is recognized and compensated equitably across roles, levels, and locations. In accordance with various State’s transparency regulations, we provide the following salary range information for this position: Base salary range: $247,000 - $275,000. The exact salary will be determined based on the selected candidate’s location, qualifications, experience, and relevant skills. Additional compensation: All full-time roles are eligible for an equity package in the form of stock options. You Belong Here Horizon3 is not just an equal opportunity employer - we are a community that values diversity, equity, and inclusion as fundamental principles of our culture and success. We are dedicated to fostering a workplace where everyone feels welcome and respected, regardless of race, color, religion, sex, national origin, age, disability, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, or any other legally protected status by law. Our commitment to diversity and inclusion means we strive to attract, develop, and retain a workforce that reflects the varied communities we serve. We believe that diverse perspectives drive innovation and strengthen our ability to create cutting-edge cybersecurity solutions. At Horizon3, every team member is valued and supported in an environment that encourages personal and professional growth. We welcome candidates from all backgrounds and experiences, and we encourage all qualified individuals to apply. Come be a part of Horizon3, where your unique contributions are recognized, and your potential is limitless. Other Duties Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee. Duties, responsibilities, and activities may change at any time with or without notice.