Senior Security Engineer, Offensive Security & Remediation

Title: Senior Security Engineer, Offensive Security & Remediation Location: United States - Remote

ABOUT THE TEAM

WW (WeightWatchers) helps millions of members build healthier habits through science-backed weight management, clinical care and community. Protecting their health and personal data is core to that trust.

Platform Security is moving from a compliance-driven program to an engineering-driven one. We are building detection and response, cloud and application security, supply chain security and identity controls, with a small team that ships real capabilities rather than paperwork.

WHAT YOU'LL DO

We're hiring a Senior Security Engineer who spends most of their time breaking things. You'll run continuous offensive testing against our TypeScript applications, APIs and AWS infrastructure, including new features as they ship to production, using both hands-on techniques and AI agent-driven workflows.

You'll also write fixes. About a third of your time goes to remediation PRs and guardrails that stop bug classes from coming back. As part of the broader product security team, you'll help run and improve our SAST, DAST, SCA, bug bounty and AI-assisted security tooling.

Offensive security (~70%)

• Plan and run red team, purple team and application penetration tests mapped to MITRE ATT&CK, focused on the threats that matter to a consumer health company: account takeover, API abuse, cloud credential misuse and data exfiltration.
• Test our TypeScript web apps and APIs for OWASP Top 10 and API Top 10 issues: broken authorization and IDOR, injection, SSRF, prototype pollution, XSS and insecure deserialization.
• Continuously test new features in production as they ship, under agreed rules of engagement: dedicated test accounts, no access to real member data, rate limits and clear stop conditions.
• Attack our identity stack (OIDC/OAuth, SSO, session handling) to validate that controls hold.
• Build and operate agentic red team workflows: LLM-driven agents for recon, attack-path discovery and continuous testing, under human oversight, with scoped targets, kill switches, audit logging and human approval before high-impact actions.
• Test our own AI features and agents for prompt injection, tool misuse and data leakage.
• Scope, manage and quality-check third-party pentest and red team engagements, from rules of engagement through retest.

Remediation and secure engineering (~30%)

• Write and ship remediation PRs in TypeScript/Node.js and React/Next.js codebases, with tests, following team review and release processes.
• Fix vulnerable npm dependencies safely: upgrades, lockfile hygiene and breaking-change handling.
• Build secure-by-default libraries and patterns (authorization middleware, input validation schemas, safe output encoding, secrets handling) that product teams adopt.
• Turn each finding class into a durable guardrail: a regression test, a custom SAST or lint rule, or a CI check.
• Use AI coding assistants and agents to speed up remediation, with human review on every change.

AWS infrastructure offensive security (stretch)

• Emulate cloud attacks across our AWS accounts: IAM privilege escalation, role-chaining and cross-account trust abuse, exposed credentials and metadata service (IMDS) abuse via SSRF.
• Test external exposure: public S3 buckets, API Gateway and Lambda misconfigurations, CloudFront and load balancer edge cases, and forgotten internet-facing assets.
• Assess EKS and Kubernetes for container escape, pod-to-cloud privilege paths and secrets exposure.
• Map attack paths from application bugs to cloud impact, and hand infrastructure fixes to platform owners with clear reproduction steps.

Product security team and tooling

• Work as part of the broader product security team, sharing priorities, findings and triage duties.
• Help run and tune our existing application security tooling: SAST, DAST and SCA, reducing false positives and routing real issues to owners.
• Triage and validate Bugcrowd submissions, reproduce reports, set severity and work with engineers on fixes and payouts.
• Use and improve Claude Security for AI-assisted vulnerability discovery and patching, checking its findings and fixes against manual testing.
• Report on outcomes: exploitable findings closed, time to remediate against SLA, bug classes eliminated and tooling signal-to-noise.

WHO YOU ARE

• 6+ years in security or software engineering, with 3+ years of hands-on offensive work (pentesting, red or purple team, or application security testing).
• Hands-on offensive experience in AWS: IAM privilege escalation, cross-account and role-trust abuse, SSRF to metadata credentials and misconfigured public services.
• Production software engineering experience in TypeScript and Node.js: you've shipped fixes that went through code review, tests and CI/CD.
• Deep knowledge of web and API vulnerabilities (OWASP Top 10, API Security Top 10) and how to fix them properly in code.
• Experience safely testing live production systems under rules of engagement.
• Working experience with SAST, DAST and SCA tools, including tuning and triaging their output.
• Hands-on experience using or building agentic workflows for offensive security, and a clear view of where they fail.
• Experience with Burp Suite or similar proxies, and scripting custom tooling in TypeScript or Python.
• Solid understanding of OAuth 2.0/OIDC, session management and authorization models.
• Clear writing: findings engineers can act on, and PR descriptions reviewers can trust.

Nice to have

• React/Next.js and a Node.js framework such as NestJS or Express.
• npm supply chain security: SBOMs, provenance, lockfile and install-script risks.
• Writing custom SAST rules (Semgrep-style) or ESLint security rules.
• Experience managing third-party pentest or red team vendors end to end.
• Agent frameworks, MCP servers or tool-calling LLM APIs; knowledge of OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Adversary-emulation tooling (e.g. Atomic Red Team, Caldera) and C2 frameworks.
• Running or triaging a bug bounty program (Bugcrowd or similar), or a personal bug bounty track record or published CVEs. Cloud offensive tooling such as Pacu, CloudFox or Prowler, and AWS certifications (e.g. AWS Security Specialty).
• Experience in regulated environments (HITRUST, SOC 2, CCPA).