Offensive Security Lead

About This RoleAI processing…

Key Responsibilities

• 1
  Lead and unify Penetration Testing and Red Team into a single, cohesive Offensive Security function — shared standards, shared tradecraft, shared reporting, distinct missions.
• 2
  Set and execute the offensive security roadmap, aligning testing scope and cadence to SoFi's risk profile, regulatory obligations, and the pace of product and platform change in the company.
• 3
  Build and scale AI-augmented offensive security capabilities — design and implement tooling and workflows (AI-assisted recon, vulnerability triage, exploit chaining, purple-team simulation, report generation) that increase the team's coverage and throughput without sacrificing depth or tradecraft.
• 4
  Personally lead and contribute to engagements where needed — network, application, cloud, and AI pentests; adversary emulation and full-scope red team operations — staying technically credible with the team you lead.
• 5
  Manage and develop the team: hire, coach, mentor, and grow a mix of penetration testers and red team operators; build clear career paths between the two disciplines and into leadership or other disciplines.
• 6
  Own program metrics and maturity: define KPIs for coverage, finding severity and remediation velocity, engagement quality, and program ROI; report progress to senior leadership and risk committees.
• 7
  Partner cross-functionally with Vulnerability Management, SOC/Incident Response, Application Security, and engineering teams to ensure offensive findings drive real remediation and inform detection engineering.
• 8
  Manage external partnerships — third-party pentest and red team tooling and/or execution vendors, — including scoping, quality oversight, and budget.
• 9
  Represent Offensive Security in audits, regulatory exams, and executive briefings, translating technical risk into business risk clearly and credibly.

Requirements

• 8+ years in offensive security, with demonstrated hands-on experience in both penetration testing and red team/adversary emulation — not just one discipline.
• Deep technical fluency across network, web/application, cloud (AWS/GCP/Azure), and mobile attack surfaces, plus familiarity with adversary emulation frameworks (e.g., MITRE ATT&CK) and C2 tooling.
• Track record of building programs from the ground up or maturing existing ones — process, tooling, metrics, and team structure, not just individual engagements.
• Relevant certifications (OSCP, OSCE, OSEP, GPEN, GXPN, CRTO, or equivalent demonstrated experience) preferred but not required in lieu of strong hands-on track record.
• We're looking for a leader who has already built and implemented AI-assisted penetration testing and red teaming programs — using AI tooling to accelerate reconnaissance, exploit development, attack-path analysis, and reporting — and who can bring that experience to bear on the program.
• If you need accommodations to participate in the job application or interview process, please let your recruiter know or email accommodations@sofi.com.
• Internal Employees If you are a current employee, do not apply here - please navigate to our Internal Job Board in Greenhouse to apply to our open roles.

Perks & Benefits