Senior Offensive Security Engineer
DRW is a Chicago-based diversified trading firm that uses technology, quantitative research, and risk management to provide liquidity across traditional and digital-asset markets.
About DRW
Founded by Don Wilson in 1992, DRW trades for its own account across global markets and operates strategies in cryptoassets, venture capital, real estate, carbon markets, and public-equity investments. Its crypto business, Cumberland, has provided institutional crypto-asset liquidity since 2014.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will lead DRW's growing offensive security capability by planning and executing red team engagements, penetration tests and adversary simulations against trading infrastructure, corporate environments and cloud platforms. You will build custom tooling, run purple-team exercises and phishing simulations, assess AI and LLM-integrated systems, track vulnerabilities through remediation, present results to technical teams and leadership, and help shape methodology and mentor other engineers.
Requirements
- 5+ years of hands-on experience in offensive security, penetration testing or red teaming across the full engagement lifecycle
- Strong scripting or programming ability for building offensive tooling
- Solid understanding of networking fundamentals, Windows, macOS and Linux internals, identity providers and cloud platforms
- Practical experience with offensive tools such as Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap
- Working knowledge of MITRE ATT&CK, adversary emulation and detection evasion
- Clear reporting and communication skills
- Experience with smart contract auditing and blockchain security
- Familiarity with AI/ML security risks including adversarial attacks and prompt injection
Responsibilities
- Plan and execute red team engagements and adversary simulations mapped to MITRE ATT&CK
- Conduct penetration tests across networks, web and internal applications, APIs and cloud infrastructure and report findings with remediation guidance
- Design and build custom tooling, scripts and exploits to emulate adversary behavior and validate detection coverage
- Partner with Security Engineering and SOC teams in purple-team exercises
- Run social engineering and phishing simulations
- Identify, validate, prioritize and track vulnerabilities through to remediation
- Present engagement results and risk narratives to technical teams and senior leadership
- Stay current on the threat landscape, emerging TTPs and offensive tooling
- Assess the security of AI and LLM-integrated systems including prompt injection, model manipulation and data poisoning
- Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery and exploit development
- Help define and mature offensive security methodology, standards and tooling, and mentor other engineers