Anaplan - Senior Offensive Security Engineer - Threat Modeling

About the Role : As a Senior Offensive Security Engineer, you will lead offensive security efforts and own Anaplans vulnerability management programme. This is a dual-scope role: youll drive adversarial testing to find whats broken, and youll run the process that ensures vulnerabilitiesfrom your own assessments, scanners, bug bounty, and third-party audits are tracked, prioritised, and remediated at the right pace. Youll mentor the Offensive Security Engineer and serve as a technical authority across product and platform teams. Individual Contributor Focus : - Operates independently on complex offensive engagements and vulnerability management decisions, setting scope and priority without close supervision. - Communicates risk and remediation trade-offs to cross-functional stakeholders at the project and product-line level, influencing engineering roadmaps where security debt is material. - Mentors the Offensive Security Engineer and security champions across engineering, but carries no direct people management responsibility. Responsibilities : Offensive Security : - Advanced Penetration Testing & Red Teaming: Lead complex, multi-phase penetration tests and red team exercises against Anaplans platform, cloud infrastructure, and AI-powered products. Define engagement scope, rules of engagement, and success criteria. - Threat Modelling & Attack Path Analysis: Conduct adversarial threat modelling for new features and architectural changes, identifying realistic attack chains that inform both offensive testing and defensive controls. - Offensive Tooling & Capability Development: Build and maintain reusable offensive tooling, automation frameworks, and testing methodologies that scale with the platforms evolution. - Mentorship & Technical Leadership: Guide the Offensive Security Engineer on methodology, scoping, and report quality. Raise the bar on how offensive findings translate into engineering action. Vulnerability Management : - Programme Ownership: Own the end-to-end vulnerability management lifecycle: intake from scanners, penetration tests, bug bounty, and third-party audits; triage and risk-rating; assignment to responsible teams; tracking through to verified remediation. - Prioritisation & Risk Calibration: Apply consistent, risk-based prioritisation that accounts for exploitability, blast radius, data sensitivity, and business contextnot just CVSS scores. - Metrics & Reporting: Define and maintain vulnerability management metrics (mean time to remediate, ageing, SLA compliance) and report trends to security leadership and engineering stakeholders. - Process Improvement: Continuously improve the vulnerability management workflow: reduce noise, improve scanner accuracy, tighten integration with CI/CD and ticketing systems, and make it easier for engineering teams to act on findings. Cross-Cutting : - Incident Support: Support major security incident investigations with offensive expertisereproducing attack paths, validating exposure scope, and advising on containment. - Stakeholder Communication: Present findings, risk assessments, and programme health to engineering leads, product managers, and security leadership with clarity and appropriate urgency. Qualifications: - Experience: 5+ years in offensive security, penetration testing, or a combination of offensive security and vulnerability management, with increasing scope and independence. - Offensive Depth: Proven ability to find and exploit non-trivial vulnerabilities in web applications, APIs, cloud infrastructure, or enterprise SaaS platforms. Comfortable building custom exploits and tooling. - Vulnerability Management: Experience designing or running a vulnerability management programme triage workflows, SLA frameworks, scanner tuning, and remediation tracking at meaningful scale. - Cloud & Infrastructure: Strong working knowledge of at least one major cloud provider (AWS, GCP, or Azure), including cloud-native attack surfaces, IAM misconfigurations, and container/orchestration security. - Technical Communication: Able to write penetration test reports that engineers respect, present risk trade-offs to non-security stakeholders, and influence remediation timelines without formal authority. - Judgement: Demonstrated ability to prioritise across competing risks balancing offensive testing coverage, vulnerability backlog, and engineering capacity without defaulting to everything is critical. Nice to Have : - Experience testing AI/ML-powered features or pipelines for security weaknesses. - Track record of improving vulnerability management metrics (MTTR, SLA adherence, backlog reduction) in a product or platform engineering context. - Offensive security certifications such as OSCP, OSWE, OSCE, CRTO, or GXPN. - Contributions to open-source offensive tooling, published vulnerability research, or conference presentations. - Experience with supply-chain security assessment (dependency Ab