About the Team

The Information Security organization at Postman operates across three pillars: Governance Risk & Compliance (GRC), Product Security, and Security Operations. We are a team of builders, not checkbox-checkers. We hold active SOC 2 Type II, ISO 27001, ISO 42001, and HIPAA compliance postures, and we are pursuing FedRAMP High and CMMC Level 2 authorization. Our security stack includes Wiz, SentinelOne, Okta, Jamf, and 1Password, and we operate across a multi-cloud environment.

The Offensive Security team is the "red" pulse of this organization. We don't just find bugs — we simulate the adversary to ensure our defenses hold up under real-world pressure. We focus on continuous security validation, AI-augmented adversary emulation, and offensive AI security research at Postman's scale.

The Opportunity

We are looking for a Senior Manager, Offensive Security who is as much a strategist as they are a hacker. You will own the strategic direction of Postman's offensive security program — including building out a dedicated Offensive AI Security capability from the ground up — and operate as a key partner to CISO leadership on threat-informed defense strategy.

This is not a role where you inherit a mature program and keep the lights on. You will shape what offensive security looks like at Postman for the next three years, with a specific mandate to make us an industry leader in adversarial testing of AI systems, agentic workflows, and LLM integrations.

You will lead a team that doesn't just "report" vulnerabilities but "demonstrates" them, using live exploits to build a deep, visceral security culture across the entire engineering organization.

What You’ll Do

Strategy & Program Ownership

• Set Strategic Direction: Define and execute the multi-year offensive security roadmap, aligning Red Team, Purple Team, and continuous validation capabilities to Postman's evolving threat landscape and business priorities.

• Build the Offensive AI Security Practice: Stand up and scale a dedicated offensive capability targeting AI/ML systems. This includes adversarial testing of LLM integrations, agentic workflows (MCP, tool-use chains), RAG pipelines, and model-serving infrastructure. You will define the methodology, tooling, and engagement frameworks from the ground up.

• Develop AI Threat Intelligence: Track and operationalize the rapidly evolving AI threat landscape — OWASP LLM Top 10, MITRE ATLAS, emerging attack research on agentic systems — translating external research into internal red team playbooks and detection hypotheses for Security Operations.

Hands-On Technical Leadership

• Red Team AI Systems at Depth: Go beyond checkbox assessments. Lead structured adversarial campaigns against Postman's LLM deployments, AI agents, and model pipelines — targeting prompt injection, tool-use abuse, data exfiltration via context manipulation, training data poisoning, model manipulation, and trust boundary violations in multi-agent architectures.

• Architect Autonomous Testing: Design and deploy AI-based penetration testing platforms and autonomous agents to perform continuous security validation across our API ecosystem.

• Continuous Validation: Move from manual pentesting to Continuous Offensive Security, integrating automated breach and attack simulation (BAS) into CI/CD pipelines, including AI model deployment pipelines.

People Leadership

• Lead & Cultivate: Build, manage, and scale a high-performing team of offensive security engineers — including specialized AI red team operators — providing mentorship, career development, and succession planning.

• Recruit for the Future: Identify and hire talent at the intersection of offensive security and AI/ML — a rare and competitive talent market. Build a pipeline that includes internal development paths for existing security engineers to cross-skill into AI red teaming.

Communication & Influence

• Drive Security Culture through "The Show": Lead live "Exploitable Demonstrations" — technical proof-of-concepts presented to engineering teams that show exactly how a vulnerability could be leveraged, turning abstract risks into tangible learning moments. Place particular emphasis on demystifying AI-specific attack vectors for non-ML engineers.

• Executive Communication: Translate offensive findings into business-level risk narratives for executive leadership, the board, and external stakeholders. Partner with GRC on audit evidence and compliance posture derived from offensive operations, including AI-specific risk frameworks (ISO 42001).

• Cross-Functional Partnership: Operate as a senior technical leader across Product Security, Security Operations, and Engineering, ensuring offensive findings — especially from AI red team engagements — drive measurable improvements in detection, response, and architecture.

About You

• Experience: Minimum of 8 years in offensive security (penetration testing, red teaming, vulnerability research, or exploit development) with at least 4 years in a people management or leadership capacity, including experience managing managers or tech leads.

• AI/ML Offensive Depth: Demonstrated experience attacking AI/ML systems — whether through adversarial ML research, LLM red teaming, agentic system exploitation, or building offensive tooling for AI targets. You understand the difference between prompt injection and indirect prompt injection, know what a tool-use confusion attack looks like, and can articulate why RAG poisoning is a supply chain problem.

• Strategic Acumen: Demonstrated ability to build and scale an offensive security program from the ground up or significantly mature an existing one. Experience setting OKRs, managing budgets, and presenting to executive leadership.

• Adversarial Mindset: Deep understanding of the modern threat landscape and how to apply it to cloud-native, API-first environments — extended to AI-native architectures.

• AI Offensive Tooling Fluency: Hands-on experience with AI-augmented pentesting tools (e.g., PentestGPT, Horizon3, custom LLM-based fuzzing) and purpose-built AI red team frameworks (e.g., Microsoft PyRIT, Garak, custom harnesses). Understanding of how to manage non-deterministic AI outputs in both offensive tooling and target systems.

• Pragmatic Storytelling: You believe that a well-executed exploit demo is more effective than a 50-page PDF. You can present a complex exploit chain — including an AI-specific attack path — to a room of developers in a way that is inspiring, not condescending.

• Engineering Fluency: You prefer building an automated "exploit-as-code" validator over performing the same manual test twice. You can architect evaluation harnesses and adversarial test suites for ML models.

Preferred

• Industry Presence: Track record of contributions to the offensive security or AI security community — conference talks (DEF CON, Black Hat, BSides, RSA), tool releases, published research, CVEs, or active participation in OWASP, MITRE, or similar working groups.

• Certifications: OSCP, OSCE, OSEP, GXPN, GPEN, CRTP, or equivalent hands-on offensive certifications. AI/ML-specific credentials (e.g., GIAC GMAI) are a differentiator.

• Cloud Security Expertise: Deep familiarity with AWS security primitives, cloud-native attack paths, and container/Kubernetes exploitation.

• API Security Depth: Experience with API-specific attack methodologies — BOLA, BFLA, mass assignment, GraphQL abuse, gRPC exploitation — reflecting Postman's core product domain.

• Compliance Awareness: Familiarity with how offensive security outputs map to SOC 2 Type II, ISO 27001, ISO 42001, FedRAMP, or CMMC control evidence. You don't run GRC, but you know how to feed it.

The reasonably estimated base salary for this role ranges from $275,000 to $300,000, plus a competitive equity package. Actual compensation is based on the candidate's skills, qualifications, and experience. 

The Opportunity

Postman is seeking a strategic and results-driven engineering leader who is passionate about APIs, partnerships, ecosystems, collaboration, and developer success.  

As the Sr. Engineering Manager for Ecosystem, you’ll build and lead a talented group of engineers, fostering a culture of collaboration, innovation, and excellence while guiding the team to build scalable, reliable, high-performance features that power the future of our Ecosystem. You’ll work closely with other engineering managers, product managers, and designers to drive the vision and execution of the product roadmap that will empower developers + partners to create rich, integrated experiences that will help teams create, collaborate, manage, and scale their APIs and solutions.  This position requires a strategic thinker with a deep understanding of developer ecosystems and a passion for delivering exceptional developer experiences.  You will define our technical strategy to achieve our ecosystem goals, including how extensibility, integration frameworks and public APIs work at Postman, how integrations look, feel, and behave to our end users, and how customers discover, install, and buy apps via a marketplace. 

If you’re passionate about building products that make an impact, have a proven track record of leading engineering teams to success, and thrive in dynamic, fast-paced environments, we want you on our team!

What You’ll Do

Team Leadership & Development

• Hire, manage, mentor, and coach several teams of engineers, helping them grow both technically and professionally.

• Drive and uphold a culture of respect, integrity, inclusion, ownership, and accountability within the team.

• Set clear goals and provide regular feedback to ensure your team is motivated and aligned with the product and company vision.

• Design strategies for developer success across many areas, including those that are still in the early stages of finding their product-market fit.

• Experiment, design, and influence rigorously the creation of new kinds of experiences for consumers and the new business models that will support builders, creators, partners, and developers.

Technical Leadership

• Facilitate and coordinate the technical design and execution of complex features for Postman’s ecosystem platform ensuring scalability, performance, and reliability for millions of customers and partners everywhere.

• Partner with leaders at strategic companies in the ecosystem to define high value product offerings through Postman app as well as the partner app and marketplaces.

• Collaborate with cross-functional teams, including product managers, designers, and other engineering managers, to deliver high-quality, customer-focused features.

• Ensure engineering best practices are upheld, including code reviews, testing, and continuous delivery.

Project Management

• Own the engineering roadmap for Ecosystem, including Developer Tooling, Strategic Integrations and Marketplace, balancing short-term delivery with long-term technical and  business investments.

• Break down complex initiatives into clear, actionable milestones and manage the delivery of these projects on time.

• Proactively identify and resolve roadblocks, ensuring your team meets its deadlines and delivers features with high quality.

Collaboration & Communication

• Work closely with stakeholders across engineering, product, and design teams to ensure alignment on priorities and deliverables.

• Foster open communication within the team, promoting collaboration and transparency.

• Represent the engineering team in meetings with leadership, advocating for technical needs and constraints while aligning with broader company goals.

Operational Excellence

• Ensure the reliability and performance of Ecosystem products by driving operational best practices for monitoring, logging, and incident response.

• Optimize the team’s workflow by implementing automation and improving processes where needed.

• Maintain a high level of code quality and system robustness by promoting test-driven development and continuous integration.

About You

You are a seasoned engineering leader with a passion for building great products, fostering strong teams, and solving challenging technical problems. You have a track record of managing high-performing engineering teams and driving technical projects from concept to delivery geared towards helping 3rd party developers build impactful apps quickly and successfully (ex. Shopify, Atlassian, HubSpot, Slack, etc.)

Must Have Qualifications:

• 10+ years of experience as a software engineer, with 5+ years in an engineering management or leadership role.

• Experience building and launching 0 → 1 ecosystem features, platform extensibility (UI components, frameworks, APIs), developer tooling and/or products for external technical audiences.

• Proven experience leading teams in fast-paced, agile environments.

• Strong background in backend or frontend development (experience with React, Java a plus).

• Demonstrated ability to coach and mentor engineers, helping them grow and succeed.

• Experience managing the full software development lifecycle, from design through production support.

• Excellent communication and interpersonal skills, with the ability to collaborate effectively with cross-functional teams.

Nice-to-Have:

• Familiarity with API development, cloud infrastructure (AWS, GCP, or Azure), and container orchestration (Kubernetes).

• Prior experience working in a SaaS or cloud-based environment.

• A passion for building systems that prioritize scalability, performance, and operational excellence.

The reasonably estimated base salary for this role ranges from $260,000 to $300,000, plus a competitive equity package. Actual compensation is based on the candidate's skills, qualifications, and experience.