Red Team Engineer

About Acrisure 

A global fintech leader, Acrisure empowers millions of ambitious businesses and individuals with the right solutions to grow boldly forward. By bringing cutting-edge technology and top-tier human support together, we connect clients with customized solutions across insurance, reinsurance, payroll, benefits, cybersecurity, mortgage services — and more.

In the last twelve years, Acrisure has grown in revenue from $38 million to nearly $5 billion, with over 19,000 colleagues in more than 20 countries. Acrisure was built on entrepreneurial spirit. Prioritizing leadership, accountability, and collaboration, we equip our teams to work at the highest levels possible.

Job Summary:

You will serve as a senior offensive security expert responsible for identifying, exploiting, and demonstrating complex attack paths across Acrisure's applications, cloud environments, AI enabled technologies, and enterprise infrastructure. This role requires deep technical expertise in application security, cloud security, software development, and adversary simulation.

As a senior member of the Information Security team, you will lead sophisticated red team engagements, design offensive testing methodologies, develop custom attack tooling, and provide strategic guidance to engineering and security leadership. You will leverage deep knowledge of secure software development practices and application architecture to uncover vulnerabilities that traditional assessments miss.

Success in this role means thinking beyond individual vulnerabilities to identify complete attack chains, demonstrating real world business impact, influencing secure design decisions, and helping mature Acrisure's offensive security capabilities.

Responsibilities:

• Lead enterprise scale red team operations simulating advanced threat actors, insider threats, and targeted attacks.

• Design and execute multi stage attack scenarios spanning applications, cloud infrastructure, identity systems, and AI enabled platforms.

• Develop custom tactics, techniques, and procedures aligned to emerging adversary behaviors and MITRE ATT&CK frameworks.

• Identify and demonstrate realistic attack paths that could result in privilege escalation, data compromise, ransomware deployment, or business disruption.

• Conduct stealth testing and detection validation exercises in partnership with SOC and Detection Engineering teams.

• Perform advanced source code reviews and architecture assessments to identify systemic security weaknesses.

• Analyze software design patterns, trust boundaries, authorization frameworks, and application workflows for exploitable weaknesses.

• Review complex codebases across .NET, C#, Java, JavaScript, TypeScript, Python, and cloud native architectures.

• Partner with engineering leadership to improve secure coding standards and application security maturity.

• Conduct deep manual penetration tests against web applications, REST/GraphQL APIs, and microservices — focusing on authentication, authorization (IDOR/BOLA), session management, injection, and business logic flaws.

• Perform source-code-assisted testing (grey-box/white-box) using access to application repositories to identify vulnerabilities that black-box testing misses.

• Test multi-tenant isolation boundaries — proving or disproving cross-tenant data access, privilege escalation, and tenant-escape scenarios in SaaS platforms.

• Assess authentication and session architectures: OAuth/OIDC flows, JWT handling, MFA bypass, token lifecycle, and session revocation effectiveness.

• Validate authorization models end-to-end — from API gateway to data layer — identifying gaps where opt-in security filters can be bypassed or omitted.

• Execute targeted assessments of high-risk application changes, new features, and integrations as part of the secure development lifecycle.

• Use AI tools (LLMs, copilots, agentic frameworks) to accelerate vulnerability discovery, payload generation, reconnaissance, and report writing.

• Build and maintain AI-assisted attack workflows — automated recon pipelines, intelligent fuzzing, pattern-based code review, and exploit chain analysis.

• Assess AI-integrated application features for prompt injection, training data leakage, model manipulation, excessive agency, and insecure output handling (OWASP LLM Top 10).

• Contribute to AI red-teaming exercises targeting LLM-powered features, chatbots, and agentic systems deployed across the enterprise.

• Stay current on AI-driven offensive techniques and defensive evasion — and translate emerging research into practical testing methodologies.

• Conduct penetration tests against cloud-hosted applications and services in AWS and Azure — including serverless functions, container workloads, and managed services.

• Test cloud identity and access configurations — IAM policies, role assumptions, cross-account access, service principal permissions, and privilege escalation paths.

• Assess API gateway configurations, WAF effectiveness, and network segmentation controls.

• Identify attack paths from application-layer compromise to cloud infrastructure pivot — demonstrating real-world impact chains.

• Build and maintain custom offensive tooling — scanners, exploit scripts, and validation frameworks tailored to the organization’s technology stack.

• Develop repeatable, automated security validation tests that can be integrated into CI/CD pipelines for continuous assurance.

• Produce clear, evidence-based penetration test reports with proof-of-concept exploits, risk ratings, and actionable remediation guidance.

• Track and retest findings through remediation — validating fixes are effective and complete.

• Contribute to the organization’s attack playbooks, TTPs documentation, and knowledge base.

• Partner with AppSec engineers to translate offensive findings into defensive tooling improvements (SAST/DAST rules, ASPM policies).

• Work with development teams during and after assessments — explaining vulnerabilities, demonstrating impact, and advising on secure design patterns.

• Support bug bounty program triage and validation when external researchers report findings.

• Participate in purple team exercises — working with detection engineering and SOC to validate monitoring coverage against real attack techniques.

• Serve as a technical leader and subject matter expert for offensive security initiatives.

• Mentor junior red team, penetration testing, and application security personnel.

• Provide executive level risk perspectives and technical recommendations to security leadership.

• Influence security strategy by identifying emerging threats, attack trends, and systemic organizational risks.

• Establish offensive security standards, methodologies, and best practices across the enterprise.

• 8+ years of progressive experience in offensive security, penetration testing, red teaming, application security, or adversary simulation.

• Deep expertise identifying and exploiting complex vulnerabilities in web applications, APIs, cloud services, and distributed systems.

• Strong software development background with demonstrated proficiency in Python, C#, JavaScript, PowerShell, Go, or similar languages.

• Ability to read, analyze, debug, and assess enterprise application source code.

• Experience developing custom offensive security tools, exploit frameworks, or vulnerability research projects.

• Extensive experience assessing authentication, authorization, identity management, and privilege escalation risks.

• Advanced understanding of application architecture, software development lifecycles, microservices, APIs, and cloud native technologies.

• Demonstrated experience leading penetration tests or red team engagements from planning through executive reporting.

• Experience conducting cloud security assessments within AWS and Azure environments.

• Ability to communicate technical findings to engineers, architects, executives, and security leadership.

#LI-CH1

Candidates should be comfortable with an on-site presence to support collaboration, team leadership, and cross-functional partnership.

Why Join Us:

At Acrisure, we’re building more than a business, we’re building a community where people can grow, thrive, and make an impact. Our benefits are designed to support every dimension of your life, from your health and finances to your family and future.

Making a lasting impact on the communities it serves, Acrisure has pledged more than $22 million through its partnerships with Corewell Health Helen DeVos Children's Hospital in Grand Rapids, Michigan, UPMC Children's Hospital in Pittsburgh, Pennsylvania and Blythedale Children's Hospital in Valhalla, New York.

Employee Benefits

We also offer our employees a comprehensive suite of benefits and perks, including:

• Physical Wellness: Comprehensive medical insurance, dental insurance, and vision insurance; life and disability insurance; fertility benefits; wellness resources; and paid sick time.

• Mental Wellness: Generous paid time off and holidays; Employee Assistance Program (EAP); and a complimentary Calm app subscription.

• Financial Wellness: Immediate vesting in a 401(k) plan; Health Savings Account (HSA) and Flexible Spending Account (FSA) options; commuter benefits; and employee discount programs.

• Family Care: Paid maternity leave and paid paternity leave (including for adoptive parents); legal plan options; and pet insurance coverage.

• … and so much more!

This list is not exhaustive of all available benefits. Eligibility and waiting periods may apply to certain offerings. Benefits may vary based on subsidiary entity and geographic location.

Acrisure is an Equal Opportunity Employer. We consider qualified applicants without regard to race, color, religion, sex, national origin, disability, or protected veteran status. Applicants may request reasonable accommodation by contacting [email protected].

Final candidates will be required to complete post-offer verification processes related to the role and in accordance with applicable laws.

California Residents: Learn more about our privacy practices for applicants by visiting the Acrisure California Applicant Privacy Policy.

Recruitment Fraud: Please visit here to learn more about our Recruitment Fraud Notice.

Welcome, your new opportunity awaits you.