Offensive Security Engineer at Oracle Cloud Infrastructure Group
Job Description
The Oracle Cloud Infrastructure (OCI) Offensive Security team provides OCI with the capabilities to ensure our systems and services meet the security objectives we communicate to customers. The Offensive Security group performs security assessments, vulnerability research, static and dynamic analysis research, penetration testing, red‑teaming, and security tool development. We ensure the security of the software and hardware that runs our cloud infrastructure and strive for continuous improvement. The OCI Offensive Security group works as a team. We don't fit people into predefined roles. We bring together the right people who enhance team capability and build roles around each team member's skills and interests.
Values are OCI's foundation and how we deliver excellence. We strive for equity, inclusion, and respect for all. We are committed to the greater good in our products and our actions. We are continually learning and taking opportunities to grow our careers and ourselves. We challenge each other to stretch beyond our past to build our future.
Our ideal candidate is a hardworking and hands‑on engineer who cares about security and improves their knowledge every day. We're looking for hands‑on cloud hackers with expertise and passion in identifying and exploiting complex security problems in distributed, multi‑tenant services and infrastructure. We operate distributed systems at a high scale worldwide.
Responsibilities
You enjoy diving into complex source code audits to reveal subtle security vulnerabilities
Writing new tools such as fuzzers in languages such as C/C++, Python, Ruby, Go or Java
Tearing apart an undocumented file format or network protocol
Coming up with novel techniques to solve unique and interesting security problems
Reviewing new services, including their integration points with existing services
Guiding security projects beyond the scope of performing assessment work, identifying and disclosing vulnerabilities to third‑party vendors, and designing complex systems and services that improve the quantity or quality of offensive security output
Driving organization‑wide improvement in the form of engineering practices, security architecture, operation practices or development practices
Balancing business and security risk while applying expertise in business‑critical security areas to advance the business relative to the industry
Qualifications
6+ years of experience in vulnerability discovery, security engineering or application security
Threat modeling experience of microservice architectures
Experience working in a large cloud or software company
Extensive research or experience with multiple classes of security bugs
Evidence of contribution to the security community in the form of training, thought leadership, conference talks or publications
Improving security throughout the organization, identifying areas of risk or opportunities for improvement and piloting them
Be a subject‑matter expert in at least one business‑critical area (e.g. cryptography, hardware security, operating systems, authentication protocols, fuzzing, DoS mitigation, networks, distributed systems)
Collaborative track record working between internal teams and external organizations
Excellent organizational, verbal and written communication skills
Intermediate knowledge of Linux OS Internals
Advanced knowledge of one programming language and ability to read two higher‑level programming languages such as Java
Preferred Qualifications
Undergraduate or Graduate degree in Electrical Engineering, Computer Science, or another related field or equivalent work experience
Hands‑on experience developing services on a public cloud platform (e.g., AWS, Azure, Oracle)
Building continuous integration/deployment pipelines with robust testing and deployment schedules
Experience working with internal customers and translating requests into prioritized work or features
Expertise in applying risk identification techniques to develop security solutions
Experience and understanding of cryptographic algorithms, standards, implementation and application
Experience and understanding of threat modeling, penetration testing, reverse engineering and attacks on software
Experience working with large enterprise customers
Career Level
IC5
About Us
As a world leader in cloud solutions, Oracle uses tomorrow’s technology to tackle today’s challenges. We’ve partnered with industry‑leaders in almost every sector—and continue to thrive after 40+ years of change by operating with integrity.
We know that true innovation starts when everyone is empowered to contribute. That’s why we’re committed to growing an inclusive workforce that promotes opportunities for all.
Oracle careers open the door to global opportunities where work‑life balance flourishes. We offer competitive benefits based on parity and consistency and support our people with flexible medical, life insurance, and retirement options. We also encourage employees to give back to their communities through our volunteer programs.
We’re committed to including people with disabilities at all stages of the employment process. If you require accessibility assistance or accommodation for a disability at any point, let us know by emailing accommodation-request_mb@oracle.com or by calling +1 888 404 2494 in the United States.
Equal Employment Opportunity
Oracle is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability and protected veterans’ status, or any other characteristic protected by law. Oracle will consider for employment qualified applicants with arrest and conviction records pursuant to applicable law.
#J-18808-Ljbffr