We are seeking a Lead Security Engineer for a developer-minded offensive security leader who can chain and automate web and network exploits at scale. You will script autonomous exploit paths, run continuous validation with tools like Pentera, Cymulate, and Picus, and guide prioritization via threat modeling and cyber threat intelligence.

Responsibilities

- Chain vulnerabilities to amplify impact, for example combining low-severity information disclosure with SSRF to reach Remote Code Execution

- Create custom exploits and automate sophisticated, multi-step authentication flows

- Set up and scale continuous, automated security validation tooling to enable ongoing vulnerability management

- Use the OSI model and core network protocols to evaluate infrastructure security posture

- Find and confirm web application weaknesses, including OWASP Top 10 issues and API flaws such as IDOR

- Build automated exploit scripts that validate vulnerabilities safely without crashing live network infrastructure or corrupting production databases

- Conduct threat modeling to map attack paths and help prioritize remediation

- Apply cyber threat intelligence to shape exploit development and validation approaches

Requirements

- Proven experience of 5+ years in security engineering or offensive security roles

- Deep expertise in cyber threat intelligence, threat modeling, and vulnerability management

- Hands-on proficiency in Python to script, orchestrate, and automate exploit chains

- Strong knowledge of OWASP Top 10 vulnerabilities and common web application security flaws





- Solid background configuring and scaling automated security validation frameworks such as Pentera, Cymulate, Picus, or custom Pentest Robots architectures

- Thorough understanding of the OSI model and essential network protocols, including DNS, BGP, and TCP/IP

- Demonstrated ability to engineer exploit scripts that safely validate production vulnerabilities without disruption

- English proficiency at B2 level (Upper-Intermediate) or higher

Nice to have

- Ability to use Bash and Go for scripting and automation

- Familiarity with Multi-Factor Authentication and programmatic handling of TOTP

- Working knowledge of OAuth protocols to automate authentication flows

We offer

- International projects with top brands

- Work with global teams of highly skilled, diverse peers

- Healthcare benefits

- Employee financial programs

- Paid time off and sick leave

- Upskilling, reskilling and certification courses

- Unlimited access to the LinkedIn Learning library and 22,000+ courses

- General career opportunities

- Volunteer and community involvement opportunities

- EPAM Employee Groups

- Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn

EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.

📌 Lead Security Engineer (México)
🏢 Epam Systems
📍 México