Security Engineer, Offensive Security
New
Looking for a security engineer job in New York? Choose from 73 open roles at 32 employers. Explore real salary data and skills breakdown across remote, hybrid and on-site roles.
Free. No credit card needed.
The titles and summaries together point to three broad clusters of work. The first is defensive and detection-oriented: roles such as vulnerability management involve continuous scanning across multi-cloud environments, triaging findings, and coordinating remediation, as seen in the Datadog vulnerability management role. The second cluster is application and product security, where engineers embed into engineering teams to conduct threat modelling, review code, design secure APIs, and build automated controls using DevSecOps tooling — the Writer application security role is a clear example. The third and growing cluster is AI-specific security: protecting generative AI systems against prompt injection, jailbreaks, and anomalous agent behaviour, as described in the Point72 GenAI role and the Zscaler AI security specialist role. Across all clusters, most postings expect hands-on coding alongside security knowledge, not security awareness alone.
Python appears in the majority of postings, making it the most consistently mentioned skill in this sample of 72. Cloud platforms — AWS, GCP, and Azure — are each referenced in roughly a third to just over half the postings. Kubernetes, Terraform, and CI/CD appear in around a quarter to a third, reflecting the infrastructure-as-code and container-native environments these engineers work in. AI-specific terms such as agents and LLMs appear in a meaningful minority, consistent with the AI security titles in the sample. Counts reflect mentions in descriptions, not formal requirements.
The employers' own advertised ranges, for individual roles at different levels — not an average and not a market rate.
Most postings in this sample specify onsite work, with a smaller proportion listed as hybrid. Only a handful indicate fully remote eligibility, so candidates who cannot commute to a New York office should check each posting carefully before applying. Hybrid arrangements, where stated, typically imply some weekly in-office presence, though the exact schedule is not stated in most postings. No postings have an unknown work mode in this set, meaning every listing does carry some location signal, even if it is simply "onsite".
Jobs checked 4 hours ago. · Guide reviewed 9 September 2026.
Search by role, company, or anything a posting mentions.
