Senior Offensive Security Engineer
DRW is a Chicago-based diversified trading firm that uses technology, quantitative research, and risk management to provide liquidity across traditional and digital-asset markets.
About DRW
Founded by Don Wilson in 1992, DRW trades for its own account across global markets and operates strategies in cryptoassets, venture capital, real estate, carbon markets, and public-equity investments. Its crypto business, Cumberland, has provided institutional crypto-asset liquidity since 2014.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will lead hands-on offensive security assessments across trading systems, corporate IT, cloud platforms, applications, APIs, and AI-integrated systems. You will plan and execute red-team engagements, penetration tests, adversary simulations, phishing exercises, and purple-team exercises. You will develop tooling and exploits, prioritize remediation, communicate risk to technical and executive stakeholders, and help mature offensive security practices.
Requirements
- 5+ years of hands-on offensive security, penetration testing, or red teaming experience
- Experience across reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration
- Scripting or programming ability for offensive tooling
- Knowledge of networking, Windows, macOS, Linux, identity providers, and cloud platforms
- Experience with Cobalt Strike, Metasploit, BloodHound, Burp Suite, and Nmap
- Knowledge of MITRE ATT&CK, adversary emulation, detection evasion, and defensive controls
- Clear technical reporting and risk communication skills
- Experience with smart contract auditing and blockchain security
- Knowledge of AI/ML security risks, adversarial model attacks, prompt injection, and LLM tooling
Responsibilities
- Plan and execute red team engagements and adversary simulations across trading systems, corporate IT, and cloud environments
- Conduct penetration tests of networks, web and internal applications, APIs, and cloud infrastructure
- Report findings with actionable remediation guidance
- Design and build custom tooling, scripts, and exploits to emulate adversary behavior and validate controls
- Partner with Security Engineering and SOC teams on purple-team exercises
- Run social engineering and phishing simulations
- Identify, prioritize, track, and validate remediation of vulnerabilities and control weaknesses
- Present engagement results and risk narratives to technical teams and senior leadership
- Assess AI and LLM-integrated systems for security risks
- Use AI-assisted tooling for reconnaissance, vulnerability discovery, and exploit development
- Define and mature offensive security methodology, standards, and tooling
- Mentor security engineers
Benefits
- Annual discretionary bonus
- Medical, pharmacy, dental, and vision insurance
- 401k with discretionary employer match
- Short- and long-term disability insurance
- Life and AD&D insurance
- Health savings accounts
- Flexible spending accounts