# Offensive Security Lead

**Company**: SoFi
**Location**: CA - San Francisco; WA - Seattle; NY - New York City; UT - Cottonwood Heights; TX - Frisco; MT - Helena
**Experience**: senior
**Job type**: full-time
**Salary**: The base pay range for this role is listed below. Final base pay offer will be determined based on individual factors such as the candidate’s experience, skills, and location.
**Category**: Security
**Industry**: Finance

**Apply**: https://job-boards.greenhouse.io/sofi/jobs/7985585003?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_abc5d0b2-6b8

## Description

SoFi's Cyber Defense organization is looking for an Offensive Security Lead to mature and grow its Penetration Testing and Red Team functions. This is a hands-on leadership role for someone who has spent years both doing the work and building the program around it.

The Role: You will own the strategy, staffing, tooling, and execution quality of both disciplines, report into Cyber Defense leadership, and act as a trusted advisor to engineering, product, and risk partners across the company. You will lead and unify Penetration Testing and Red Team into a single, cohesive Offensive Security function.

Responsibilities:

- Lead and unify Penetration Testing and Red Team into a single, cohesive Offensive Security function

- Set and execute the offensive security roadmap, aligning testing scope and cadence to SoFi's risk profile, regulatory obligations, and the pace of product and platform change in the company

- Build and scale AI-augmented offensive security capabilities

- Personally lead and contribute to engagements where needed

- Manage and develop the team: hire, coach, mentor, and grow a mix of penetration testers and red team operators

- Own program metrics and maturity: define KPIs for coverage, finding severity and remediation velocity, engagement quality, and program ROI

- Partner cross-functionally with Vulnerability Management, SOC/Incident Response, Application Security, and engineering teams to ensure offensive findings drive real remediation and inform detection engineering

- Manage external partnerships

- Represent Offensive Security in audits, regulatory exams, and executive briefings

Requirements:

- 8+ years in offensive security, with demonstrated hands-on experience in both penetration testing and red team/adversary emulation

- 2+ years directly managing or leading offensive security teams, ideally within a regulated industry

- Proven experience designing and implementing AI-led or AI-assisted offensive security programs

- Deep technical fluency across network, web/application, cloud, and mobile attack surfaces

- Track record of building programs from the ground up or maturing existing ones

- Strong written and verbal communication skills

Compensation and Benefits: The base pay range for this role is listed below. Final base pay offer will be determined based on individual factors such as the candidate's experience, skills, and location.

## Skills

### Required
- penetration testing
- red team
- adversary emulation
- AI-assisted offensive security
- network security
- web/application security
- cloud security
- mobile security
- MITRE ATT&CK
- C2 tooling

### Nice to have
- OSCP
- OSCE
- OSEP
- GPEN
- GXPN
- CRTO

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/sofi/jobs/7985585003?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)