Senior Product Security Engineer

As a Senior Product Security Engineer at Astranis, you are a software engineer with a deep specialization in security, responsible for designing and building secure systems with a focus on areas like cryptography, Public Key Infrastructure (PKI) and zero trust architectures. Your role  will involve evaluating processes, operating systems, and applications from a security-first engineering standpoint. While your primary role is to build secure software, your expertise will be used to identify vulnerabilities, conduct risk analyses, and lead security reviews.

Role

• Audit embedded devices to identify security vulnerabilities and weaknesses.
• Lead security initiatives and serve as a point of contact for secure software development.
• Conduct security research and risk assessments on our products, focusing on cryptographic implementations and protocols.
• Provide expert guidance and support in the implementation of security measures.
• Collaborate with vendors, partners, and other Astranis software engineers to implement effective remediation strategies.
• Perform risk assessments to identify and prioritize threats.
• Lead design teams in developing secure systems and ensure our products are implemented to a high security standard.
• Collaborate with software development teams to design and implement technical solutions that address identified risks.

Requirements

• 5+ years of experience in software engineering with a focus on security.
• Strong investigative, analytical problem-solving skills and attention to detail.
• Experience with secure architecture design for embedded devices.
• Security expertise as a software specialist in one or more of: C, C++, ARM, cryptography, PKI.
• Proven experience in threat modeling and security assessments, with commensurate ability in offensive security.
• Expert proficiency in software development, including auditing and writing secure code.
• Strong knowledge of security best practices and frameworks.
• Strong communication skills, both written and spoken.
• Ability to work collaboratively within a team environment.

Vulnerability Management Analyst

Astranis is looking for a Vulnerability Management Analyst who is ready to proactively identify and neutralize threats before they materialize. Our ideal candidate is passionate about security and has a talent for discovering vulnerabilities, assessing risk, and orchestrating remediation across a diverse technological landscape. With the threat landscape constantly shifting, we need a sharp, detail-oriented individual who can stay ahead of potential exploits, safeguard our systems, and ensure the resilience and integrity of our digital infrastructure.

Role

• Handle all vulnerability scans across the enterprise, including identifying application and configuration vulnerabilities.
• Develop, manage, and track patching and remediation plans in collaboration with system owners.
• Perform and validate system patching and configuration fixes across Windows, macOS, and Linux operating systems.
• Assess the risk of and prioritize vulnerabilities based on their criticality, system exposure, and potential business impact.
• Operate and maintain the vulnerability management platform (Tenable) to ensure effective scanning and reporting.
• Analyze scan results, create detailed reports on the vulnerability landscape, and communicate findings to technical teams and leadership.
• Assist in developing and maturing the overall vulnerability management program and associated policies and procedures.
• Stay current with emerging threats, vulnerabilities, and security technologies to continuously improve our security posture.

Requirements

• 1+ years of experience in a security-related role, with a strong background in security principles.
• Proven experience in cybersecurity, specifically in vulnerability management, risk assessment, and patch management.
• Hands-on experience with vulnerability management tools, especially Tenable.
• Strong understanding of how to assess risk and determine the criticality of security vulnerabilities.
• Experience with patching and security configuration for Windows, macOS, and Linux environments.
• A strong understanding of security standards, system hardening principles, and industry best practices.
• Strong analytical and problem-solving skills.
• Ability to work both independently and collaboratively in a team environment.

Bonus

• Relevant experience with security vulnerability scanners
• Experience in a fast-paced, high-tech, or aerospace environment.
• Familiarity with container security or cloud security vulnerability management.
• Proficient in at least one scripting language, such as Python.

Security Operations Analyst

Astranis is looking for a Security Operations Analyst who isn’t afraid to dive headfirst into the digital abyss. Our ideal candidate is enthusiastic about security and has a knack for dissecting malware, untangling the complex webs of phishing schemes, and leading the charge during incident response operations. With cyber threats evolving at breakneck speed, we need a sharp, resourceful individual who is always two steps ahead of the game, ready to protect our digital frontier and ensure the security and integrity of our data and systems.

Role

• Monitor and analyze security alerts and incidents in real-time using Google SecOps or similar SIEM tools. Investigate and respond to security events promptly and effectively
• Collaborate with others to identify and mitigate security incidents. Provide support during security incidents and assist in post-incident analysis
• Analyze and blow up malware to understand its behavior, origins, and impact, using this intelligence to fortify our defenses
• Investigate phishing attempts, identifying attack vectors and advising on preventive measures
• Create, integrate, and operate security tools
• Assist in purple team exercises
• Maintain and update security documentation, including procedures, runbooks, and policies related to security operations
• Participate in the improvement of security monitoring and incident response processes
• Learn and utilize various cybersecurity tools and technologies

Requirements

• 1+ years of experience in a security related role
• Proven experience in cybersecurity, specifically in incident response, malware analysis, and phishing investigation
• A firm grasp of security concepts and technologies
• A strong understanding of security standards, hardening principals, and best practices
• Strong analytical and problem-solving skills
• Ability to work both independently and collaboratively in a team environment
• Excellent written and oral communication skills
• Don’t meet all the requirements? Not a problem. Please apply anyway

Bonus

• Any relevant certifications such as CISSP or CEH
• Experience blowing up malware and looking into phishes
• Previous experience with Google SecOps (or Chronicle)

Product Security Engineer

As a Product Security Engineer at Astranis, you are a software engineer with a passion for security, responsible for building and securing our web applications and services. Your role will involve embedding security into the software development lifecycle, from design to deployment. While your primary role is to build secure software in Python and modern web stacks, your expertise will be used to identify vulnerabilities, conduct security reviews, and help engineering teams raise the bar for security across the board.

Role

• Perform security code reviews and penetration testing on our web applications and services.
• Contribute to security initiatives and serve as a security champion within software development teams.
• Provide guidance and support to developers on implementing security measures and secure coding best practices.
• Collaborate with vendors, partners, and other Astranis software engineers to implement effective remediation strategies.
• Perform risk assessments to identify and prioritize threats in our applications and infrastructure.
• Work with development teams during the design phase to build secure systems and ensure our products are implemented to a high security standard.
• Collaborate with software development teams to design and implement technical solutions that address identified risks.

Requirements

• 2+ years of experience in software engineering with a focus on security.
• Strong investigative, analytical problem-solving skills and attention to detail.
• Experience with secure coding practices for web applications.
• Software development experience and security expertise in Python and modern web frameworks (e.g., Django, Flask, React).
• Proven experience in threat modeling and security assessments for web applications.
• Proficiency in software development, including auditing and writing secure code.
• Strong knowledge of security best practices, common vulnerabilities, and frameworks.
• Strong communication skills, both written and spoken.
• Ability to work collaboratively within a team environment.

Senior Offensive Security Engineer

As a Senior Offensive Security Engineer, you will lead penetration testing and adversarial simulation efforts targeting our applications, cloud infrastructure, and corporate networks. You will emulate real-world attackers to identify weaknesses across the software and IT stack, and work closely with engineering and IT teams to improve our defenses. Your focus is offensive testing of application and enterprise systems.

Role

• Offensive & Penetration Testing (Primary)
  • Perform penetration tests of web apps, APIs, backend services, cloud infrastructure, and corporate networks.
  • Conduct threat emulation exercises, red-team scenarios, and targeted attack simulations.
  • Assess CI/CD pipelines, IAM configurations, and internal services for exploitable weaknesses.
  • Lead offensive security initiatives and serve as the organization’s primary expert for AppSec and enterprise pentesting.
• Security Research & Adversarial Analysis
  • Track emerging threats, techniques, and vulnerabilities relevant to cloud and enterprise environments.
  • Develop custom exploits or proof-of-concepts as needed to validate findings.
• Collaboration & Remediation Support
  • Work with development, infra, and IT teams to validate controls and guide effective remediation.
  • Provide actionable risk assessments from an attacker’s perspective.
  • Contribute offensive insights to secure system design guidance.
• General Product Security Support (Secondary)
  • Assist with code review and threat modeling for software components when offensive insights are needed.

Requirements

• 5+ years of hands-on offensive security experience (AppSec, cloud, or enterprise penetration testing).
• Demonstrated experience leading complex penetration tests for web apps, APIs, and cloud platforms.
• Strong proficiency in offensive tooling (Burp Suite, Nmap, Metasploit, proxy tools, etc.) and manual testing techniques.
• Familiarity with cloud-native attack vectors (AWS/Azure/GCP).
• Proficiency in at least one scripting or exploitation-oriented language (Python, Go, JavaScript, etc.).
• Strong analytical and problem-solving skills with an attacker’s mindset.
• Ability to explain complex technical vulnerabilities to a range of audiences.

Red Team Security Engineer

Astranis is looking for a Red Team Security Engineer who thinks like an adversary and views security as an art form. Our ideal candidate thrives on the challenge of finding novel ways to bypass defenses and has a natural talent for uncovering hidden attack paths. We need a creative, persistent, and resourceful individual who can emulate real-world threat actors, testing our resilience from every angle—cyber, physical, and human. This role is for the hacker at heart, dedicated to making our defenses stronger by proving where they can be broken.

Role

• Actively devise and execute sophisticated, multi-stage attack campaigns that emulate the tactics, techniques, and procedures (TTPs) of relevant threat actors.
• Identify and exploit vulnerabilities across the organization's digital and physical landscapes, including networks, applications, facilities, and personnel.
• Conduct covert red team operations, including network penetration testing, application security assessments, social engineering, and physical security breach simulations.
• Lead and participate in purple team exercises, working collaboratively with the blue team to analyze attack paths, test detection capabilities, and improve incident response playbooks in real-time.
• Assess the effectiveness of remediation efforts by re-testing identified vulnerabilities and attack paths after fixes have been implemented.
• Develop custom tooling and scripts to automate and enhance attack simulations.
• Create detailed post-engagement reports that clearly document findings, articulate business risk, and provide actionable recommendations for improving security posture.
• Act as the resident subject matter expert on offensive security and threat actor methodologies.

Requirements

• 3+ years of experience in an offensive security role (e.g., Red Teaming, Penetration Testing).
• Proven experience in planning and executing covert red team operations from reconnaissance to objective completion.
• A deep understanding of attacker TTPs and frameworks like MITRE ATT&CK.
• Proficient in at least one scripting language, such as Python, for tooling and automation.
• Hands-on experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, Burp Suite, custom implants).
• Strong analytical and problem-solving skills with a creative and unconventional mindset.
• Ability to work both independently and collaboratively in a team environment.
• Excellent written and oral communication skills, with the ability to articulate complex technical risks to both technical and non-technical audiences.
• Don’t meet all the requirements? Not a problem. Please apply anyway.

Bonus

• Any relevant certifications such as OSCP, OSCE, or OSEP.
• Experience with physical security assessments or social engineering campaigns.
• Previous experience building and running a red team program.

Senior Product Security Engineer

As a Senior Product Security Engineer, you will help secure both the software and embedded components that power our systems. This hybrid role focuses primarily on product/application security while contributing to embedded security reviews where software and hardware intersect. You will guide secure design, evaluate critical components, and partner closely with engineering teams across the stack to ensure our products are secure by default. This role does not expect deep hardware hacking but requires a broad security mindset to provide expertise where embedded systems and software meet.

Role

• Lead threat modeling, architecture reviews, and design-level risk assessments for both application and embedded system components.
• Conduct secure code reviews for critical modules in Python and C/C++, supporting secure coding practices across all engineering teams.
• Evaluate cryptographic usage, authentication/authorization flows, and protocol security across the stack.
• Identify and prioritize vulnerabilities in software and firmware; partner with developers on remediation and mitigation strategies.
• Participate in security assessments of embedded devices, especially where software interfaces with hardware.
• Provide security input on high-level aspects of secure boot, firmware update integrity, and device identity mechanisms.
• Partner with software, firmware, hardware, and systems teams to implement consistent, secure solutions.

Requirements

• 5+ years of experience in software engineering with a focus on security.
• Strong investigative, analytical problem-solving skills and attention to detail.
• Experience with secure architecture design and threat modeling for complex systems (including both web services and IoT/embedded devices).
• Software development and security expertise in both high-level languages (e.g., Python) and low-level languages (e.g., C, C++).
• Experience with security best practices for web applications (OWASP Top 10) and familiarity with embedded security concepts (e.g., secure boot, JTAG, UART).
• Proven ability in auditing code for security flaws across different technology stacks.
• Strong knowledge of security best practices, applied cryptography, and security frameworks.
• Strong communication skills, with the ability to discuss security with both software and hardware engineers.
• Ability to work collaboratively within a multi-disciplinary team environment.