Manager, Offensive Security

About Si Time Si Time  is the Precision Timing company. Timing is the heartbeat of all electronics, ensuring performance, resilience and scalability. For decades, quartz devices, non-silicon technology, have kept systems in sync, but they struggle in harsher, more demanding environments. MEMS-based Precision Timing delivers greater accuracy, smaller size and resilience. Today, MEMS timing powers over 400 applications, including high-growth ones in AI datacenters, automated driving, industrial and humanoid robots, wearables and IoT.Our

semiconductor MEMS programmable solutions offer a rich feature set that enables customers to differentiate their products with higher performance, smaller size, lower power, and better reliability. With more than 4 billion devices shipped, SiTime is changing the timing industry. For more information, visit: .

Job Summary Reporting to the CISO, this role leads SiTime's Offensive Security function. It owns penetration testing, red and purple team exercises, vulnerability disclosure and bug bounty, and validation that the controls SiTime has bought and built actually work.

This is a build role. The candidate will design a recurring testing program that covers the enterprise, cloud, SaaS, application and laboratory estates, establish adversary simulation against realistic objectives, and create the feedback loop that turns findings into improved detection and hardening rather than a report that is filed away.

It is also a people-leadership role. The candidate starts hands-on, personally running the first cycle of testing, then scales through a mix of full-time testers and specialist firms engaged where independence or niche capability is required.

This is an accountable owner role, not an advisory one. Findings are owned through to verified closure in partnership with Security Engineering, Vulnerability Management and Security Operations, Security Architecture, IT and Engineering.

We value diverse experiences, perspectives, and career paths, and welcome candidates who are excited to contribute to our mission.

Responsibilities:

Offensive Testing Program Run a recurring penetration testing program across enterprise, cloud, SaaS, application, network and laboratory environments, covering both grey box and black box engagements.

Scope, plan and execute internal testing, and manage external testing firms where specialist capability or independence is required.

Prioritize testing around the paths that reach design data, source code repositories, laboratory and test networks, and partner and OSAT connectivity.

Own the finding lifecycle end to end: severity, named owner, remediation service level, retest and closure with evidence.

Move the program from point-in-time assessment toward continuous validation of the controls that matter most.

Red Team, Purple Team and Detection Validation Design and run threat-informed red team exercises against realistic objectives, with clear rules of engagement and authorization.

Run purple team exercises jointly with Security Operations to validate and improve detection coverage, mapping results to MITRE ATT&CK.Validate that deployed controls detect and prevent, and route the gaps to Security Engineering and Security Operations with reproducible evidence.

Simulate insider and data exfiltration scenarios to test data loss prevention, access controls and monitoring on the design environment.

Contribute technical injections and scenarios to ransomware and crisis tabletop exercises.

Track adversary tradecraft relevant to semiconductors, hardware and intellectual property theft, including state-linked activity, and translate it into test scenarios.

Disclosure, Bug Bounty and Program Scaling Stand up and run vulnerability disclosure and bug bounty…