Security Engineer, Red Team

📋 Job Overview

🚀 Join the Future of Commerce with Whatnot!

Whatnot is the largest live shopping platform in North America and Europe to buy, sell, and discover the things you love. Whether it's trading cards, fashion, electronics, or live plants, our sellers are building real businesses across hundreds of categories. We're building live commerce at a scale that's never been done in the West, and there's no playbook to copy. The people here are shaping how an entirely new industry develops.

As a remote co-located team, we're inspired by our values and anchored in hubs across the US, UK, Ireland, Poland, Germany, and Australia. We move fast, stay close to our users, and focus on the work that drives the most impact.

We're one of the fastest growing marketplaces and were recently named the #1 Best Startup Employer in America by Forbes. Check out the latest Whatnot updates on our news and engineering blogs and join us as we enable anyone to turn their passion into a business and bring people together through commerce.

🏢 About Whatnot

We're building the future of live commerce. Our platform connects millions of users with sellers across hundreds of categories, from trading cards to fashion to electronics. As a remote-first company with hubs around the world, we're redefining how people shop and interact online. We're proud to be named the #1 Best Startup Employer in America by Forbes and continue to grow rapidly.

🎯 The Role

Plan and run authorized red team operations across cloud (AWS), Kubernetes, networks, identity systems, SaaS, and internal applications, under written rules of engagement. Build and maintain AI-assisted testing harnesses: agent loops that run recon, attack-path discovery, fuzzing, and exploit validation with logging, scoping controls, and human approval gates. Use LLMs and agentic tools to speed up vulnerability research, payload and test-case generation, code review, and report drafting, and measure where they help and where they mislead. Red team our own AI systems: prompt injection, tool and connector abuse, data exfiltration, model and agent permission boundaries, and supply chain risk in AI dependencies. Emulate realistic adversaries using MITRE ATT&CK and ATLAS, chaining findings into end-to-end attack paths rather than isolated bugs. Run purple team exercises with detection engineering and incident response, and tune detections based on what your tests evade. Write clear findings with reproduction steps, impact, and recommended fixes; track remediation to closure and retest. Automate regression tests so fixed weaknesses stay fixed, and feed results into CI/CD pipelines. Document and share techniques, tooling, and lessons learned with engineering teams. Work collaboratively with Whatnot’s Blue Team on Purple Team engagements to help strengthen Whatnot’s overall security posture.

✅ Key Responsibilities

• Plan and execute authorized red team operations across cloud (AWS), Kubernetes, networks, identity systems, SaaS, and internal applications
• Build and maintain AI-assisted testing harnesses for security testing
• Utilize LLMs and agentic tools to scale offensive security testing
• Red team Whatnot's AI systems for security vulnerabilities
• Emulate realistic adversaries using MITRE ATT&CK and ATLAS frameworks
• Conduct purple team exercises with detection engineering and incident response teams
• Document security findings and track remediation to closure
• Automate security regression tests and integrate with CI/CD pipelines
• Share security techniques, tooling, and lessons learned with engineering teams

📌 Required Qualifications

• 3+ years in offensive security, red teaming, or penetration testing
• Strong programming skills in Python with ability to build custom tooling
• Hands-on experience building LLM-powered workflows or agents
• Deep knowledge of at least two areas: cloud security and IAM abuse, Active Directory or identity attacks, Kubernetes and container escapes, web and API exploitation, CI/CD and supply chain attacks
• Working knowledge of AI-specific risks: prompt injection, insecure tool use, data leakage, excessive agent permissions, and model supply chain issues
• Sound judgment on scope, safety, and blast radius
• Clear written communication skills for technical and executive audiences

🎁 Benefits

Generous Holiday and Time off Policy
Health Insurance options including Medical, Dental, Vision
Work From Home Support
Home office setup allowance
Monthly allowance for cell phone and internet
Care benefits
Monthly allowance for wellness
Annual allowance towards Childcare
Lifetime benefit for family planning, such as adoption or fertility expenses
Retirement; 401k offering for Traditional and Roth accounts in the US (employer match up to 4% of base salary) and Pension plans internationally
Monthly allowance to dogfood the app
Parental Leave: 16 weeks of paid parental leave + one month gradual return to work

🛂 Visa & Eligibility

Whatnot is proud to be an Equal Opportunity Employer. We value diversity, and we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, parental status, disability status, or any other status protected by local law.