Offensive Security Engineer

Live Ramp is the data collaboration platform of choice for the world’s most innovative companies. A groundbreaking leader in consumer privacy, data ethics, and foundational identity, Live Ramp is setting the new standard for building a connected customer view with unmatched clarity and context while protecting precious brand and consumer trust. Live Ramp offers complete flexibility to collaborate wherever data lives to support the widest range of data collaboration use cases—within organizations, between brands, and across its premier global network of top-quality partners.

Hundreds of global innovators, from iconic consumer brands and tech giants to banks, retailers, and healthcare leaders turn to Live Ramp to build enduring brand and business value by deepening customer engagement and loyalty, activating new partnerships, and maximizing the value of their first-party data while staying on the forefront of rapidly evolving compliance and privacy requirements.

The Offensive Security Engineer is responsible for proactively identifying, validating, and helping remediate security weaknesses across the company’s SaaS platform, which includes multiple customer-facing web applications, APIs, backend microservices, and cloud-native infrastructure deployed across a multi-cloud environment. This role works closely with Engineering, Dev Ops/Dev Sec Ops , and Product teams to ensure that vulnerabilities are discovered early, reliably reproduced, documented, and remediated efficiently, with minimal impact to production systems or data.

The Offensive Security Engineer will help lead internal offensive security initiatives (e.g., Pentest), lead red team exercises, participate in blue or purple team exercises, assess emerging exploits, participate in incident response exercises when applicable, and assist in maturing the company’s security posture.

• Cloud, Application, and API Security Testing:
  Perform authorized application security pentests on web apps, APIs, cloud infrastructure, and microservices; identify common classes of vulnerabilities (e.g., authentication/authorization weaknesses, logic flaws, input validation issues); validate findings and provide actionable guidance to engineering teams; conduct and contribute to threat modeling and design reviews; maintain the internal pentest framework and update it based on industry standards where applicable.
• Cloud & Platform Security Assessments:
  Work with Cloud/Dev Ops engineers to secure CI/CD pipelines; work with containerized workloads and serverless components.
• Vulnerability Discovery & Research:
  Obtain a strong understanding of the company’s products and architecture to discover high-impact weaknesses; research emerging attacks/exploits and techniques relevant to multi-cloud, SaaS, or microservice architectures.
• Internal Red Team / Purple Team
  
  Activities:
  
  Scope and engineer red team exercises with defined flags, goals, and safety boundaries; partner with defensive teams during purple team engagements to improve detection and response.
• Collaboration & Remediation Support:
  Provide engineering teams with reproduction steps, risk context, and prescriptive remediation options; participate in security design discussions and architecture reviews.
• Security Automation & Tooling:
  Assist in automation of safe, controlled security testing (e.g., integrating SAST/DAST tooling, security checks within CI/CD); develop scripts or utilities to support secure testing workflows; implement and test emergent exploit tooling to support ongoing changes in the threat landscape.
• Compliance & Documentation:
  Maintain documentation for vulnerability assessments/pentest, retesting, and mitigation tracking in ITSM tooling; support SOC 2, ISO 27001, and customer security questionnaires by providing validated security test evidence and technical POVs when necessary.

Proactively identifies, validates, and prioritizes exploitable risks across endpoints, applications, APIs, cloud, and the external attack surface. By combining vulnerability detection, penetration testing, bug bounties, and cyber threat intelligence, TVM delivers actionable findings and partners…