About the Role :

As a Senior Offensive Security Engineer, you will lead offensive security efforts and own Anaplans vulnerability management programme. This is a dual-scope role: youll drive adversarial testing to find whats broken, and youll run the process that ensures vulnerabilitiesfrom your own assessments, scanners, bug bounty, and third-party audits are tracked, prioritised, and remediated at the right pace. Youll mentor the Offensive Security Engineer and serve as a technical authority across product and platform teams.

Individual Contributor Focus :

- Operates independently on complex offensive engagements and vulnerability management decisions, setting scope and priority without close supervision.
- Communicates risk and remediation trade-offs to cross-functional stakeholders at the project and product-line level, influencing engineering roadmaps where security debt is material.
- Mentors the Offensive Security Engineer and security champions across engineering, but carries no direct people management responsibility.

Responsibilities :

Offensive Security :

- Advanced Penetration Testing & Red Teaming: Lead complex, multi-phase penetration tests and red team exercises against Anaplans platform, cloud infrastructure, and AI-powered products. Define engagement scope, rules of engagement, and success criteria.
- Threat Modelling & Attack Path Analysis: Conduct adversarial threat modelling for new features and architectural changes, identifying realistic attack chains that inform both offensive testing and defensive controls.
- Offensive Tooling & Capability Development: Build and maintain reusable offensive tooling, automation frameworks, and testing methodologies that scale with the platforms evolution.
- Mentorship & Technical Leadership: Guide the Offensive Security Engineer on methodology, scoping,



and report quality. Raise the bar on how offensive findings translate into engineering action.

Vulnerability Management :

- Programme Ownership: Own the end-to-end vulnerability management lifecycle: intake from scanners, penetration tests, bug bounty, and third-party audits; triage and risk-rating; assignment to responsible teams; tracking through to verified remediation.
- Prioritisation & Risk Calibration: Apply consistent, risk-based prioritisation that accounts for exploitability, blast radius, data sensitivity, and business contextnot just CVSS scores.
- Metrics & Reporting: Define and maintain vulnerability management metrics (mean time to remediate, ageing, SLA compliance) and report trends to security leadership and engineering stakeholders.
- Process Improvement: Continuously improve the vulnerability management workflow: reduce noise, improve scanner accuracy, tighten integration with CI/CD and ticketing systems, and make it easier for engineering teams to act on findings.

Cross-Cutting :

- Incident Support: Support major security incident investigations with offensive expertisereproducing attack paths, validating exposure scope, and advising on containment.
- Stakeholder Communication: Present findings, risk assessments, and programme health to engineering leads, product managers, and security leadership with clarity and appropriate urgency.

Qualifications:

- Experience:



5 years in offensive security, penetration testing, or a combination of offensive security and vulnerability management, with increasing scope and independence.
- Offensive Depth: Proven ability to find and exploit non-trivial vulnerabilities in web applications, APIs, cloud infrastructure, or enterprise SaaS platforms. Comfortable building custom exploits and tooling.
- Vulnerability Management: Experience designing or running a vulnerability management programme triage workflows, SLA frameworks, scanner tuning, and remediation tracking at meaningful scale.
- Cloud & Infrastructure: Solid working knowledge of at least one major cloud provider (AWS, GCP, or Azure), including cloud-native attack surfaces, IAM misconfigurations, and container/orchestration security.
- Technical Communication: Able to write penetration test reports that engineers respect, present risk trade-offs to non-security stakeholders, and influence remediation timelines without formal authority.
- Judgement: Demonstrated ability to prioritise across competing risks balancing offensive testing coverage, vulnerability backlog, and engineering capacity without defaulting to everything is critical.

Nice to Have :

- Experience testing AI/ML-powered features or pipelines for security weaknesses.
- Track record of improving vulnerability management metrics (MTTR, SLA adherence, backlog reduction) in a product or platform engineering context.
- Offensive security certifications such as OSCP, OSWE, OSCE, CRTO, or GXPN.
- Contributions to open-source offensive tooling, published vulnerability research, or conference presentations.
- Experience with supply-chain security assessment (dependency analysis, build pipeline integrity, SBOM).

📌 Anaplan - Senior Offensive Security Engineer - Threat Modeling (India)
🏢 Anaplan
📍 India