About the Role

Vancord is seeking an experienced Senior Security Engineer to work across our offensive and defensive security teams. This role sits on the Offensive Security team and reports to Offensive Security leadership. The majority of your day-to-day work will be penetration testing and engagement delivery, and a meaningful portion of your time will be spent inside our Security Operations Center building and validating the detections that catch the attacks you spend the rest of your week executing.

We are looking for someone who is deeply capable on the offensive side and genuinely interested in the defensive side, not someone who tolerates it. The value of this role comes from the feedback loop between the two. Techniques you use against client environments become detection content in Vancord's Vantage MDR service. Gaps you find in our detection coverage become priorities for the next round of testing. If you have ever finished a report and wished you could build the alert that would have caught you, this is that job.

About Vancord

Vancord provides managed services across infrastructure and security. As a senior member of the security engineering team, you will play a meaningful role across the project pipeline, from presales engineering and scoping through testing execution and final delivery of high-quality services and reports for both technical and executive audiences. You will also contribute directly to the detection engineering that protects our managed security clients.

How the Role Splits

Offensive work is the primary function and drives your schedule. Client engagements, scoping commitments, and report deadlines take precedence. Defensive work fills the remainder and is expected to be substantial rather than incidental, with dedicated capacity between engagements and during slower periods in the testing calendar. Expect the balance to shift week to week rather than following a fixed ratio.

Responsibilities

Offensive Security

• Lead and perform in depth penetration tests across a wide range of digital infrastructures, including web applications and network systems, to identify and exploit vulnerabilities.
• Own the end-to-end delivery of security engagements, including scoping, testing, and presentation of findings to clients.
• Create detailed reports outlining methods used and the implications of findings, proposing actionable mitigation strategies tailored to both technical and executive audiences.
• Evaluate and analyze results from security assessments of cloud infrastructure and services such as AWS, Azure, Microsoft 365, and Google Workspace.
• Develop and refine playbooks, repeatable processes, and internal tooling to improve consistency, efficiency, and knowledge distribution across the team.
• Contribute to presales engineering efforts, including scoping engagements and advising on testing approaches.
• Stay current on penetration testing methodologies, tooling, and threat landscape developments, and translate them into refined testing strategies and expanded team capability.

Detection Engineering and Defensive Operations

• Develop and tune detection content across Elastic Security, Microsoft Defender XDR, Microsoft Sentinel, and CrowdStrike Falcon, writing and maintaining correlation rules, analytics, and hunting queries in KQL, ES|QL, EQL, and equivalent query languages.
• Map detection coverage against MITRE ATT&CK, identify gaps, and help drive the roadmap to close them.
• Improve signal to noise through systematic tuning, suppression logic, and enrichment rather than ad hoc fixes, and document the reasoning so analysts understand what a rule catches, what it misses, and why it fires.
• Build automation workflows in Vancord's SOAR platform to accelerate triage, enrichment, and response, reducing analyst manual workload and mean time to respond.
• Conduct structured threat hunts across the managed customer fleet, informed by current adversary tradecraft and your own offensive experience.
• Serve as a senior technical resource during complex investigations and high severity incidents, contributing attacker perspective to scoping, containment, and root cause analysis.
• Support ECS aligned telemetry pipelines and normalization workflows so that detections operate on consistent, high-fidelity data across a multi-tenant environment.
• Keep detection content consistent across the platforms Vancord operates, contributing to detection-as-code practices as they mature, so a detection built for one customer platform reaches the rest of the fleet.
•