Senior Offensive Security Engineer

Work on security that reflects real-world threats. In this Senior Offensive Security Engineer role at Unity Technologies SF (Olympia, WA onsite), you will run realistic adversary emulation and red teaming across engine and editor, client runtime, cloud and corporate environments, ads and monetization systems, and AI-native experiences. The focus is practical: chain weaknesses into real impact, deliver clear, prioritized findings, and work with engineering teams to drive fixes that stick.

Salary: USD 160,300 - 305,400 per yearly. Experience: 6+ years.

How you’ll contribute

• Plan and lead objective-based red team operations targeting Unity’s cloud, corporate, and production environments, aligned to threats relevant to Unity.
• Run purple team exercises with Security Operations to test and improve detection and response.
• Conduct deep security testing of Unity products and services, including web applications and APIs, the engine/editor, client runtime, ads and monetization systems, and developer-facing platforms.
• Discover and demonstrate attack paths across multi-cloud environments (GCP, AWS, Azure), Kubernetes and containers, CI/CD pipelines, identity, and secrets.
• Test LLM integrations, AI-native products, and agent workflows for issues such as prompt injection, data leakage, tool misuse, and excessive permissions.
• Write clear, prioritized findings with realistic impact, partner with owning teams on remediation, and retest to confirm fixes.
• Build and maintain tools, scripts, and automation that scale adversarial engineering and convert repeated findings into continuous checks.

What you bring

• 6+ years of offensive security experience (red teaming, penetration testing, purple teaming, or vulnerability research), including leading end-to-end engagements.
• Hands-on ability to attack cloud environments (GCP, AWS, or Azure), including identity, Kubernetes and containers, and CI/CD.
• Strong web application and API security testing skills, including finding logic flaws beyond scanner results.
• Solid scripting or programming ability (for example Python, Go, or C/C++) to build tools and exploits.
• Experience running adversary emulation or red team operations against realistic objectives and working alongside defenders in purple team exercises.
• Clear written and verbal communication to explain technical risk to engineers and non-technical leaders.
• An enjoyment of teamwork, with a collaborative approach to sharing ideas, supporting others, and celebrating wins together.

Technologies you’ll work with

• Python, Go, C/C++
• GCP, AWS, Azure
• Kubernetes, CI/CD
• LLM integrations

Benefits that support you

• Comprehensive health, life, and disability insurance
• Commute subsidy
• Employee stock ownership
• Competitive retirement/pension plans
• Generous vacation and personal days
• Support for new parents through leave and family-care programs
• Office food snacks
• Mental Health and Wellbeing programs and support
• Employee Resource Groups
• Global Employee Assistance Program
• Training and development programs
• Volunteering and donation matching program

What success looks like in the first 12 months

• A risk-based testing plan across Unity’s highest-value targets, agreed with security leadership and owning engineering teams.
• Several end-to-end red team or adversary emulation operations completed, each with findings, executive-ready readouts, and tracked remediation.
• Measurable improvements in detection from purple team exercises with Security Operations.
• Reusable tooling or automation that turns recurring classes of findings into continuous checks.

Additional strengths (helpful, not mandatory substitutes)

• Experience testing LLM-based products, AI agents, or AI-assisted developer tools.
• Reverse engineering, binary exploitation, or game client and anti-cheat security experience.
• Experience in gaming, ad tech, or large developer-facing platforms.
• Bug bounty, CVEs, conference talks, published research, or open-source security tooling.
• Relevant certifications (OSCP, OSEP, OSWE, CRTO) are useful but will not replace a strong track record.