Offensive Security Engineer
Read straight from Sporty Group's careers page, verified 3d ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
LocationEurope - Remote, Global - Remote
Work moderemote · Germany
Typefull-time
SenioritySenior
Experience5+ yrs
DepartmentIT & IS
Company size501–1,000 people
PostedJul 7, 2026 · 4mo ago
Verified live3d ago
At a glanceSummarised by Seekless from the posting.
5+ years of hands-on experience in offensive security, perimeter penetration testing, network security assessments, red teaming, or adversary emulation
Strong understanding of external asset discovery, DNS configuration vulnerabilities, and public IP network routing
Practical experience auditing and testing Linux and Windows environments and underlying network services
Proven ability to perform adversary emulation and bypass techniques against modern EDR/XDR solutions
Familiarity with testing physical office network hardware, routers, switches, firewalls, and workplace IT systems
Ability to turn external exposures and technical network risks into clear, actionable fixes for IT and Security teams
Experience with core web vulnerabilities and limited, scoped testing of modern API interfaces
Strong scripting ability in Python, PowerShell, Bash, or similar to automate perimeter mapping, emulation workflows, and asset discovery
Good understanding of scanning, reconnaissance, and interception tools
Strong documentation skills
One or more of the listed offensive security certifications
Skills
Active Directory
C2
CrowdStrike
SentinelOne
Microsoft Defender XDR
Kerberos
ADCS
AWS
Python
PowerShell
Bash
Linux
Windows
MITRE ATT&CK
OSINT
Benefits
Remote work
Performance bonus
Paid annual leave
Referral bonus
Flash bonus
Equipment
Company retreat
About the role
Mission: Emulate the full kill chain of the real-world adversaries that target our business. As our Red Team Expert, you plan and execute full-scope, objective-driven operations from external initial access through phishing, C2, lateral movement, privilege escalation, and Active Directory domain compromise, all the way to actions on objective against our most critical assets. You operate covertly against a mature, monitored environment, defeat modern EDR/XDR and detection controls, and prove exactly how far a determined attacker could get. You then turn every operation into concrete detection engineering wins and defensive improvements alongside our Blue Team.
What you’ll be doing
•
Scope, plan, and execute full-scope red team engagements and long-horizon adversary emulation campaigns mapped to real threat-actor TTPs and the MITRE ATT&CK framework.
•
Execute the complete attack chain: OSINT and reconnaissance, initial access (phishing, payload delivery, public-facing exploitation), establishing and operating covert C2, persistence, privilege escalation, lateral movement, and domain/cloud takeover.
•
Develop and deploy custom tooling, payloads, and C2 infrastructure; build and maintain resilient, OPSEC-safe redirector and command-and-control environments.
•
Research and weaponize EDR/XDR evasion and bypass techniques — in-memory execution, process injection, AMSI/ETW tampering, and defense-evasion tradecraft — against CrowdStrike, SentinelOne, and Microsoft Defender XDR.
•
Compromise Active Directory and hybrid/cloud identity: Kerberos attacks, ACL and delegation abuse, ADCS exploitation, and lateral movement across on-prem and cloud infrastructure (AWS).
•
Run assumed-breach, insider-threat, and social-engineering scenarios, including physical and office-network intrusion paths where in scope.
•
Work directly with the Blue Team to replay attack chains, validate and tune detections, and measurably close detection and response gaps.
•
Document full attack narratives, kill-chain diagrams, and reproducible proof-of-concept steps that let defenders rebuild and detect every stage.
•
Translate operational findings into prioritized, actionable remediation and detection-engineering guidance for IT, Network, and Security teams.
•
Track operational metrics: objectives achieved, detection and response times, dwell time, evasion success rates, and remediation follow-through.
•
Contribute to maturing Sporty’s red team capability and threat-informed defense, sharing tradecraft with internal offensive and defensive staff.
What you’ll bring
Experience (required)
•
5+ years of hands-on experience in offensive security, perimeter penetration testing, network security assessments, red teaming, or adversary emulation.
•
Strong understanding of external asset discovery, DNS configuration vulnerabilities, and public IP network routing.
•
Practical experience auditing and testing Linux and Windows environments and underlying network services.
•
Proven ability to perform adversary emulation and bypass techniques against modern EDR/XDR solutions.
•
Familiarity with testing physical office network hardware, routers, switches, firewalls, and workplace IT systems.
•
Ability to turn external exposures and technical network risks into clear, actionable fixes for IT and Security teams.
•
Experience with core web vulnerabilities and limited, scoped testing of modern API interfaces.
•
Strong scripting ability in Python, PowerShell, Bash, or similar to automate perimeter mapping, emulation workflows, and asset discovery.
•
Good understanding of scanning, reconnaissance, and interception tools.
•
Strong documentation skills.
Certifications (one or more required)
•
OffSec: OSCP / OSCP+, OSEP, OSWE, OSED, OSCE3 (or legacy OSCE), OSWA, OSMR, OSEE
•
Hack The Box: CPTS, CBBH, CWEE, CAPE
•
Red Team / Active Directory: CRTO, CRTL (Zero-Point Security); CRTP, CRTE, CRTM (Altered Security)
•
GIAC: GPEN, GXPN, GWAPT, GRTP, GCPN
•
Other recognized: PNPT (TCM Security), eCPPT / eWPTX / eMAPT (INE), BSCP (PortSwigger), CREST CRT / CCT, CPTE
Community and competitive track record
•
Bug bounty recognition: bounty awards, hall-of-fame listings, or published CVEs through HackerOne, Bugcrowd, Intigriti, YesWeHack, or vendor-run programs.
•
CTF achievements: active player on a ranked CTFtime team, Hack The Box Hall of Fame or Pro Lab completions, or finalist/podium placements in recognized competitions (DEF CON CTF, Google CTF, HTB Business CTF, SANS Holiday Hack, and similar).
What’s in it for you
•
Sporty is a remote first company in pursuit of sustainability
•
A competitive salary + individual performance based bonuses every quarter
•
28 days paid annual leave
•
Our core working hours are 10am-3pm in your local time zone with flexibility outside of this
•
Referral bonuses & flash bonuses
•
Top of the line equipment
•
Annual company retreats to provide great internal networking opportunities
Interview process
•
Remote video screening with our Talent Acquisition Team
•
Offline Take home assignment
•
Remote video interview with Team Members (60 Mins)
•
Final discussion with the hiring manager (60 mins)
If you’re interested, we encourage you to apply! Every application is reviewed by a member of our team (AI is not used in our recruitment process), and we aim to respond within 48 hours. We are committed to maintaining a fair, secure and authentic recruitment process. Applications submitted using false, misleading or fraudulent information, including impersonated or fake profiles, will not be considered. Where reasonably necessary to protect the integrity and security of our recruitment process, we may verify a candidate’s identity and/or the accuracy of information provided during the recruitment process. Any such checks will be carried out in a proportionate and appropriate manner and in accordance with applicable data protection and employment laws.