Staff Security Engineer

New York, NY, United States

Join a leading fintech company that’s democratizing finance for all.

Robinhood was founded on a simple idea: that our financial markets should be accessible to all. With customers at the heart of our decisions, Robinhood is lowering barriers and providing greater access to financial information. Together, we are building products and services that help create a financial system everyone can participate in.

As we continue to build...

We’re seeking curious, growth minded thinkers to help shape our vision, structures and systems; playing a key-role as we launch into our ambitious future. If you’re invigorated by our mission, values, and drive to change the world — we’d love to have you apply.

Robinhood has a primary in-office working environment; please be sure you have reviewed the preferred working location(s) for this role before applying.

About the team:

Robinhood is looking for an Offensive Security Engineer who is passionate about Red Teaming, Adversarial Simulation, and breaking / fixing systems, to join the Red Team.

The Red Team is a core pillar of the Offensive Security team and situated within the Safety & Productivity Engineering organization. The Red Team works with teams across Robinhood to ensure our products, services, and processes are secure through threat modeling, penetration testing, adversarial simulations, and red teaming.

Here are some examples of things our team does frequently that you’ll be heavily involved with:

Red Teaming to validate assumptions, facilitate decisions, and improve our ability to detect and respond to incidents.

Perform threat modeling against critical and new services. Articulate the actual security risk to risk working groups.

Penetration testing our critical infrastructure, production applications, networks, offices, and processes.

Sparring with Detection and Response and other stakeholders via Adversarial Simulations to prepare for incidents.

Partnering with the physical security team to conduct assessments of Robinhood properties.

Serving as a technical advocate and Subject Matter Expert for privacy and security decisions, designs, and discussions.

Driving innovative ideas to implementation as the company evolves and grows.

Conduct vulnerability research to understand latest TTPs, exploits, and forward looking capabilities

Leaving things better than you found them by partnering to fix the issues and not just finding broken things.

What you’ll do day-to-day:

Evangelize the Offensive Security Team’s Findings and Projects with stakeholders throughout the company and collaborate with other teams to create solutions that balance security with other priorities.

Mentor and provide guidance to the members of the Offensive Security team.

Utilize threat modeling to identify threats and shape Red Team priorities and exercises.

Plan and execute long term, broadly scoped, black box Red Team exercises utilizing vulnerability research, exploit development, and utilizing public proof of concept code.

Perform penetration testing, code reviews, and design/architecture reviews.

Write tooling to assist with and automate Red Team assessments.

Plan and participate in Adversarial Simulation exercises with various security teams

Lead Security Incidents when Pentest or Red Team findings require them.

Publish blog posts and present talks at security conferences.

About you:

5+ years of experience being a Senior member of a Red Team and mentoring other team members.

Passion and demonstrated experience for challenging security assumptions.

Excellent written and verbal communication skills and ability to communicate your findings at many different levels of abstraction from Engineers to Executives

Passion for fixing security issues and not just identifying security issues.

Familiarity with common network protocols and standards such as DNS and TCP/IP.

Experience with MacOS and Linux.

Experience with leveraging components of a modern software development stack to attack companies, including CI, container orchestration systems (Kubernetes/Docker), cloud providers (AWS, GCP), etc and be able to give hardening suggestions.

Experience/knowledge of defensive tools/techniques (IDS/IPS, Packet Capture, Network Analysis, AV, EDR, etc.) and how to evade them.

Deep understanding of Mitre’s ATT&CK Framework

Strong understanding of the security fundamentals of access and identity

Comfortable reading / writing python, go, and javascript

Ability to research and execute a testing plan to access a new technology or process

Demonstrated experience working with a distributed team

Proficiency to communicate over a text-based medium (Slack, JIRA Issues,  GitHub issues, & Email) and can succinctly document technical details.

Bonus points:

Experience in the Financial Technology domain

Experience being a technical lead at other organizations

Base pay for the successful applicant will depend on a variety of job-related factors, which may include education, training, experience, location, business needs, or market demands. You can view comp zones for our US office locations in the table below. For other locations not listed, compensation can be discussed with your recruiter during the interview process.

Office locations (by comp zone)

US Zone 1: Menlo Park, NYC, Seattle, Washington DC

US Zone 2: Denver, Westlake (Dallas), Chicago

US Zone 3: Lake Mary

Click here to learn more about Robinhood’s Benefits.

Robinhood promotes diversity and provides equal opportunity for all applicants and employees. We are dedicated to building a company that represents a variety of backgrounds, perspectives, and skills. We believe that the more inclusive we are, the better our work (and work environment) will be for everyone. Additionally, Robinhood provides reasonable accommodations for candidates on request and respects applicants' privacy rights. To review Robinhood's Privacy Policy please visit Robinhood - US Applicant Privacy Policy. If you are an applicant located in the UK or EEA, please visit the Robinhood - UK/EEA Applicant Privacy Policy.