We're looking for a Staff Attack Engineer to be the technical lead for internal network and Active Directory attack capabilities in NodeZero, our autonomous pentesting platform.
Active Directory is still the beating heart of most enterprise breaches, and it is exactly where our customers most need NodeZero to find and safely prove the exploitable paths that lead to domain and enterprise compromise. This is a highly strategic role. The environments we operate in are hardening fast (NTLM deprecation, SMB signing on by default, Kerberos-only and tiered-admin designs), and at the same time the tradecraft is moving quickly across AD Certificate Services, SCCM and other management planes, delegation abuse, coercion and relay, and hybrid identity. We need someone who lives on that frontier and can keep NodeZero ahead of it.
You'll own the technical direction for our internal and AD attack domain: setting the research and content roadmap, acting as the go-to subject matter expert, and raising the bar for the engineers building alongside you.
This is not consulting or manual pentesting. The goal is to turn cutting-edge, often manual techniques into safe, reliable, repeatable attacks that run autonomously across the largest internal environments in the world. If you love both breaking Active Directory and building the software that does it, this is the seat.
Serve as the technical lead and primary subject matter expert for internal-network and Active Directory attack capabilities across NodeZero.
Research emerging AD and internal tradecraft (AD Certificate Services abuse, SCCM/ConfigMgr and other management-plane attacks, Kerberos abuse and delegation including RBCD, NTLM and Kerberos coercion and relay, shadow credentials, ACL and GPO abuse, and hybrid identity pivots) and turn it into production attack content.
Design, build, and maintain production-grade Python that powers these capabilities safely and at enterprise scale.
Focus on modern, hardened environments (NTLM deprecation and SMB signing by default, Kerberos-only, Protected Users and tiered admin, LAPS and gMSA/dMSA) and build attacks that still succeed when the easy paths are closed.
Stand up, configure, and exploit representative AD test environments to validate, demonstrate, and regression-test attack scenarios.
Extend our attack-path modeling and graph data model to represent new identity, privilege-escalation, and lateral-movement paths.
Set priorities and the coverage roadmap based on real customer environments, threat intelligence, and emerging techniques.
Mentor and level up attack engineers, and raise the bar on code quality, research rigor, and operational safety.
Qualification
OSCP (or OSEPExperience with SCCMPublic contributions to the field
Preferred
OSCP (or OSEP, CRTO, or equivalent offensive certifications).
Experience with SCCM, Windows Admin Center, and other modern Windows management-plane attack surfaces.
Experience with hybrid identity attacks (Entra ID and Entra Connect, primary refresh tokens, seamless SSO) and on-prem to cloud pivots.
Experience developing or contributing to offensive tooling like BloodHound, Impacket, netexec, etc.
Familiarity with graph databases (Neo4j) and attack-path analysis.
Experience integrating security research into production, multi-tenant SaaS.
Public contributions to the field: open-source tools, technical blog posts, conference talks, or published CVEs.
Experience building production-safe autonomous or automated offensive tooling.
