Remote Offensive Security Consultant Jobs
Remote offensive security consultant jobs are open across the U.S. at remote-first firms, distributed security teams, and enterprise organizations in sectors like financial services, healthcare, technology, and government contracting. Employers hiring remotely right now include Google, Trace3, and Alteryx. See the openings below and apply to the ones that match your experience.
Find JobsOverview
Showing 5 of 13+ Remote Offensive Security Consultant jobs
About Delinea:
Delinea is the identity security platform that continuously controls what AI agents, humans and machines can do and for how long. It extends privileged access management from the point of access to the moment of action, using just-in-time authorization to reduce standing privilege across on-premises, multi-cloud and short-lived infrastructure, without adding friction for legitimate users. Delinea provides visibility across every identity type, scores the risk each one carries, and preserves the context behind access decisions, making them auditable and defensible. It supports both static and ephemeral access, letting teams apply Zero Standing Privilege where risk demands it without replacing existing infrastructure.
Summary:
Delinea’s Cybersecurity organization is seeking a Senior Offensive Security Engineer to mature Delinea’s in-house Offensive Security program. The ideal candidate will be highly collaborative, working alongside Product Development, DevOps, IT, and SecOps teams to shape the future of Penetration Testing and Red Teaming at Delinea and continually test the security of our products and the enterprise. The Senior Offensive Security Engineer will embrace the opportunity to work across diverse platforms with a variety of tools and will play a key role as we continually improve our capabilities over time. They’ll work with an established team of talented and dedicated teammates to achieve our security objectives.
This is a challenging and impactful role with the opportunity to work with both internal and external stakeholders. The candidate must be able to balance the right level of security with business objectives, communicate clearly with technical as well as non-technical audiences, and work to creatively solve complex problems.
This role reports to the Sr. Manager, Offensive Security, is based in the United States, and is fully remote.
What You'll Do:
- Lead the build out of red and purple team operations, emulating real-world adversary TTPs to test the security controls and detection and response capabilities protecting Delinea’s enterprise and
- Lead internal and external network and infrastructure penetration tests across Delinea’s enterprise and product environments, including Azure and AWS.
- Identify and exploit attack paths in identity infrastructure, including Active Directory, Entra ID, Kerberos, and credential and secrets exposure.
- Perform source code review in support of testing engagements, leveraging findings to execute targeted attacks.
- Create or reproduce and demonstrate proof-of-concept exploits for findings and externally reported vulnerabilities.
- Plan and execute penetration testing engagements from beginning to end, including scoping, rules of engagement, testing, documentation, reporting, and remediation validation.
- As needed, perform manual and automated security testing of Delinea’s web applications, APIs, desktop and agent-based clients, and cloud services, with a focus on authentication, authorization, session management, and privileged access workflows.
- Write clear, well-supported penetration test reports, including reproduction steps, risk ratings, business impact, and actionable remediation guidance.
- Partner with Product Development, DevOps, and IT teams to explain findings, support root cause analysis, and validate remediation.
- Develop and maintain custom tools, scripts, and automation to improve testing efficiency and coverage.
- Contribute to the team’s testing methodologies, playbooks, and testing environments, including the use of frontier AI models in the evaluation of product sources and attack paths.
- Stay current on emerging vulnerabilities, exploitation techniques, and attacker tradecraft, and share knowledge with the team and the broader engineering organization.
- Communicate effectively with stakeholders at all levels, translating technical findings into actionable insights and recommendations for both technical and non-technical audiences.
What You'll Bring:
- Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent work experience.
- Minimum 3+ years of demonstrated, hands-on experience with internal and external web application, API, and network penetration testing, inc luding writing formal penetration test reports that document test details, vulnerabilities, and risks.
- Understanding of penetration testing methodology and frameworks (MITRE ATT&CK, OWASP, PTES), including the OWASP Top 10 and OWASP API Security Top 10.
- Hands-on experience with industry-standard offensive tooling, such as Burp Suite, Nmap, Metasploit, BloodHound, and Impacket.
- Experience testing identity and authentication mechanisms, including Active Directory, Entra ID, Kerberos, OAuth 2.0, OpenID Connect, and SAML.
- Proficiency in at least one scripting or programming language, such as Python, Go, or PowerShell, for tooling, automation, and exploit development.
- Ability to read and review source code in common languages, such as C#, Java, or JavaScript/TypeScript, to identify security vulnerabilities.
- Experience with Azure and AWS cloud-based infrastructure.
- Understanding of the Secure Software Development Lifecycle (SSDLC).
- Skill in illustrating and explaining security vulnerabilities, including proof-of-concept demonstrations, to audiences with minimal expertise in security.
- Ability to manage multiple engagements concurrently and meet deadlines with minimal supervision.
We'd Love to See:
- One or more of the following certifications: ARTE, BSCP, CARTS, CRTL, CRTO, CRTP, eCPPT, eWPT, GPEN, GWAPT, OSCP, OSEP, OSWE, Pentest+, PNPT.
- Experience with command-and-control frameworks, such as Cobalt Strike, Sliver, or Mythic, and adversary emulation.
- Experience testing containerized and cloud-native environments, including Kubernetes, infrastructure-as-code, and CI/CD pipeline security.
- Experience testing identity and access management, privileged access management, or secrets management products.
- Experience both using AI and LLM-based agents and tooling in testing methodologies and testing AI and LLM-based features and agents, including prompt injection and the OWASP Top 10 for LLM Applications.
- Published CVEs, bug bounty participation, CTF competition, or other public security research contributions.
- Experience working with high-security environments subject to regulations such as FedRAMP or ITAR.
- Excellent analytical and problem-solving skills with a keen attention to detail.
For this Job, Delinea is not considering candidates that need any type of US work authorization now or in the future. This includes, but is not limited to: F1-OPT, F1-CPT, H-1B, TN, L-1, J1, etc.
Why work at Delinea?
We're passionate problem-solvers helping the world's largest organizations protect what matters most: their human and machine identities.
We invest in people who are smart, self-motivated, and collaborative.
What we offer in return is meaningful work, a culture of innovation and great career progression.
At Delinea, our core values are STRONG and guide our behaviors and success:
Spirited - We bring energy and passion to everything we do
Trust - We act with integrity and deliver on our commitments
Respect - We listen, value different perspectives, and work as one team
Ownership - We take initiative and follow through
Nimble - We adapt quickly in a fast-changing environment
Global - We embrace diverse people and ideas to drive better outcomes
We believe weaving these core values into our day-to-day actions, and our process for hiring, evaluating, and promoting employees, helps us cultivate a work environment that embraces collaboration and camaraderie.
We take care of our employees. We offer competitive salaries, a meaningful bonus program, and excellent benefits, including healthcare insurance, as well as pension/retirement matching, comprehensive life insurance, an employee assistance program, time off plans, and paid company holidays.
Delinea is an Equal Opportunity and Affirmative Action employer and prohibits discrimination and harassment of any type with regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.
Upon conditional offer of employment, candidates are required to complete comprehensive criminal background check, verification of education, and verification of employment, per employment policy. In addition, all publicly posted social media sites may be reviewed.
Compensation Range: $150K - $175K
About Delinea:
Delinea is the identity security platform that continuously controls what AI agents, humans and machines can do and for how long. It extends privileged access management from the point of access to the moment of action, using just-in-time authorization to reduce standing privilege across on-premises, multi-cloud and short-lived infrastructure, without adding friction for legitimate users. Delinea provides visibility across every identity type, scores the risk each one carries, and preserves the context behind access decisions, making them auditable and defensible. It supports both static and ephemeral access, letting teams apply Zero Standing Privilege where risk demands it without replacing existing infrastructure.
Summary:
Delinea’s Cybersecurity organization is seeking a Senior Offensive Security Engineer to mature Delinea’s in-house Offensive Security program. The ideal candidate will be highly collaborative, working alongside Product Development, DevOps, IT, and SecOps teams to shape the future of Penetration Testing and Red Teaming at Delinea and continually test the security of our products and the enterprise. The Senior Offensive Security Engineer will embrace the opportunity to work across diverse platforms with a variety of tools and will play a key role as we continually improve our capabilities over time. They’ll work with an established team of talented and dedicated teammates to achieve our security objectives.
This is a challenging and impactful role with the opportunity to work with both internal and external stakeholders. The candidate must be able to balance the right level of security with business objectives, communicate clearly with technical as well as non-technical audiences, and work to creatively solve complex problems.
This role reports to the Sr. Manager, Offensive Security, is based in the United States, and is fully remote.
What You'll Do:
- Lead the build out of red and purple team operations, emulating real-world adversary TTPs to test the security controls and detection and response capabilities protecting Delinea’s enterprise and
- Lead internal and external network and infrastructure penetration tests across Delinea’s enterprise and product environments, including Azure and AWS.
- Identify and exploit attack paths in identity infrastructure, including Active Directory, Entra ID, Kerberos, and credential and secrets exposure.
- Perform source code review in support of testing engagements, leveraging findings to execute targeted attacks.
- Create or reproduce and demonstrate proof-of-concept exploits for findings and externally reported vulnerabilities.
- Plan and execute penetration testing engagements from beginning to end, including scoping, rules of engagement, testing, documentation, reporting, and remediation validation.
- As needed, perform manual and automated security testing of Delinea’s web applications, APIs, desktop and agent-based clients, and cloud services, with a focus on authentication, authorization, session management, and privileged access workflows.
- Write clear, well-supported penetration test reports, including reproduction steps, risk ratings, business impact, and actionable remediation guidance.
- Partner with Product Development, DevOps, and IT teams to explain findings, support root cause analysis, and validate remediation.
- Develop and maintain custom tools, scripts, and automation to improve testing efficiency and coverage.
- Contribute to the team’s testing methodologies, playbooks, and testing environments, including the use of frontier AI models in the evaluation of product sources and attack paths.
- Stay current on emerging vulnerabilities, exploitation techniques, and attacker tradecraft, and share knowledge with the team and the broader engineering organization.
- Communicate effectively with stakeholders at all levels, translating technical findings into actionable insights and recommendations for both technical and non-technical audiences.
What You'll Bring:
- Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent work experience.
- Minimum 3+ years of demonstrated, hands-on experience with internal and external web application, API, and network penetration testing, inc luding writing formal penetration test reports that document test details, vulnerabilities, and risks.
- Understanding of penetration testing methodology and frameworks (MITRE ATT&CK, OWASP, PTES), including the OWASP Top 10 and OWASP API Security Top 10.
- Hands-on experience with industry-standard offensive tooling, such as Burp Suite, Nmap, Metasploit, BloodHound, and Impacket.
- Experience testing identity and authentication mechanisms, including Active Directory, Entra ID, Kerberos, OAuth 2.0, OpenID Connect, and SAML.
- Proficiency in at least one scripting or programming language, such as Python, Go, or PowerShell, for tooling, automation, and exploit development.
- Ability to read and review source code in common languages, such as C#, Java, or JavaScript/TypeScript, to identify security vulnerabilities.
- Experience with Azure and AWS cloud-based infrastructure.
- Understanding of the Secure Software Development Lifecycle (SSDLC).
- Skill in illustrating and explaining security vulnerabilities, including proof-of-concept demonstrations, to audiences with minimal expertise in security.
- Ability to manage multiple engagements concurrently and meet deadlines with minimal supervision.
We'd Love to See:
- One or more of the following certifications: ARTE, BSCP, CARTS, CRTL, CRTO, CRTP, eCPPT, eWPT, GPEN, GWAPT, OSCP, OSEP, OSWE, Pentest+, PNPT.
- Experience with command-and-control frameworks, such as Cobalt Strike, Sliver, or Mythic, and adversary emulation.
- Experience testing containerized and cloud-native environments, including Kubernetes, infrastructure-as-code, and CI/CD pipeline security.
- Experience testing identity and access management, privileged access management, or secrets management products.
- Experience both using AI and LLM-based agents and tooling in testing methodologies and testing AI and LLM-based features and agents, including prompt injection and the OWASP Top 10 for LLM Applications.
- Published CVEs, bug bounty participation, CTF competition, or other public security research contributions.
- Experience working with high-security environments subject to regulations such as FedRAMP or ITAR.
- Excellent analytical and problem-solving skills with a keen attention to detail.
For this Job, Delinea is not considering candidates that need any type of US work authorization now or in the future. This includes, but is not limited to: F1-OPT, F1-CPT, H-1B, TN, L-1, J1, etc.
Why work at Delinea?
We're passionate problem-solvers helping the world's largest organizations protect what matters most: their human and machine identities.
We invest in people who are smart, self-motivated, and collaborative.
What we offer in return is meaningful work, a culture of innovation and great career progression.
At Delinea, our core values are STRONG and guide our behaviors and success:
Spirited - We bring energy and passion to everything we do
Trust - We act with integrity and deliver on our commitments
Respect - We listen, value different perspectives, and work as one team
Ownership - We take initiative and follow through
Nimble - We adapt quickly in a fast-changing environment
Global - We embrace diverse people and ideas to drive better outcomes
We believe weaving these core values into our day-to-day actions, and our process for hiring, evaluating, and promoting employees, helps us cultivate a work environment that embraces collaboration and camaraderie.
We take care of our employees. We offer competitive salaries, a meaningful bonus program, and excellent benefits, including healthcare insurance, as well as pension/retirement matching, comprehensive life insurance, an employee assistance program, time off plans, and paid company holidays.
Delinea is an Equal Opportunity and Affirmative Action employer and prohibits discrimination and harassment of any type with regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.
Upon conditional offer of employment, candidates are required to complete comprehensive criminal background check, verification of education, and verification of employment, per employment policy. In addition, all publicly posted social media sites may be reviewed.
Compensation Range: $150K - $175K
See All 13 Remote Offensive Security Consultant Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsRemote Offensive Security Consultant Job Market
Who's Hiring
Top Industries Hiring
- Consulting & Professional Services
What Employers Look For
The qualifications that appear most often in remote offensive security consultant jobs.
- One or more of OSCP, GPEN, GXPN, or CEH certifications required
- Hands-on experience with penetration testing tools such as Metasploit, Burp Suite, and Cobalt Strike
- Demonstrated ability to write clear technical reports for both technical and executive audiences
- Experience conducting network, web application, or red team assessments in enterprise environments
- Bachelor's degree in computer science, information security, or a related field preferred
- Familiarity with common compliance frameworks including PCI-DSS, HIPAA, NIST, and FedRAMP
Tips for Your Remote Offensive Security Consultant Job Search
Apply early to remote roles that fit
Migrate Mate lists remote offensive security consultant openings from across the U.S. in one place. Search roles that match your skills and seniority level and apply directly while postings are fresh, since remote roles in this field fill quickly.
Show async reporting skills upfront
Remote offensive security clients judge consultants heavily on written deliverables. Include sanitized report samples or executive summary excerpts in your portfolio. Clear, well-structured findings with actionable remediation guidance demonstrate you can communicate risk without an in-person debrief.
Prove your toolchain in public work
Remote hiring managers can't watch you work, so publish your methodology. Bug bounty writeups, capture-the-flag solutions, or a GitHub repository showing custom scripts and tooling in Cobalt Strike, Burp Suite, or BloodHound give concrete evidence of technical depth.
Prepare for async technical screening
Many remote offensive security teams use take-home labs or asynchronous technical challenges instead of live coding interviews. Practice documenting your approach as you go, not just the final outcome. Reviewers want to see how you think, scope, and pivot under realistic conditions.
Remote Offensive Security Consultant Jobs: Frequently Asked Questions
How do I get a remote offensive security consultant job?
Remote offensive security consultant roles go to candidates who can demonstrate self-direction, strong written communication, and the ability to deliver findings without hand-holding. Remote employers screen heavily for independent scoping, clean report writing, and proficiency with tools like Cobalt Strike, Burp Suite, and Metasploit. Certifications like OSCP or CRTO strengthen your case, and a portfolio of past engagements or public research gives remote hiring managers something concrete to evaluate.
Which companies hire remote offensive security consultants?
Remote offensive security consultant roles are posted by Google, Trace3, and Alteryx and others right now, based on current remote listings on Migrate Mate as of November 2026. The companies doing this hiring tend to be remote-first security consultancies, distributed MSSPs, and enterprise technology and financial services firms with global security programs.
Can you get a remote offensive security consultant job with no experience?
Yes, but remote entry-level offensive security roles are harder to land because employers expect you to work independently from day one with minimal oversight. Smaller remote-first security firms and boutique consultancies are more likely to take on junior candidates. Building a home lab, earning an OSCP, publishing writeups, and contributing to bug bounty programs gives hiring managers something concrete to evaluate in the absence of professional experience.
Do you need a degree for remote offensive security consultant jobs?
Not always. Remote offensive security employers consistently weigh demonstrated skill, certifications, and real engagement experience over formal education. Credentials like OSCP, GPEN, or CRTO carry significant weight, and a portfolio showing penetration testing methodology, clean reporting, and tool proficiency can open doors that a degree alone cannot. Some government contracting roles may list degree requirements, but most commercial remote positions focus on what you can do.
Which industries hire the most remote offensive security consultants?
Remote offensive security consultant roles concentrate in Consulting & Professional Services, based on current remote listings on Migrate Mate as of November 2026. These sectors hire offensive security consultants remotely because their distributed teams and cloud-heavy infrastructure require ongoing adversarial testing that can be conducted and reported without an on-site presence.
See All 13 Remote Offensive Security Consultant Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs