Staff Security Engineer, Instacart

• 7+ years of experience in offensive security, penetration testing, or a related field, with proven expertise in red team operations
• Strong understanding of adversary tactics, techniques, and procedures (TTPs), as well as frameworks like MITRE ATT&CK
• Skilled in developing custom exploits, tools, or scripts using programming languages (e.g., Python, Go, C/C++, etc.)
• Proficient in penetration testing for various environments, such as web applications, cloud infrastructures, and on-prem systems
• Strong knowledge of Windows, Linux, and macOS operating systems, including relevant exploitation techniques
• Experience conducting collaborative purple team exercises and improving detection and response strategies
• Ability to deliver comprehensive findings and recommendations tailored to technical and non-technical audiences
• Exceptional organizational and self-management skills for handling complex, cross-functional projects

Desirable

• As a Staff Security Engineer, Red Team, you will lead offensive security efforts to proactively identify vulnerabilities, simulate real-world threats, and measure the effectiveness of defenses across Instacart’s systems
• You will design and execute creative red team campaigns while collaborating with blue teams and other stakeholders to strengthen our ability to detect, respond to, and remediate threats swiftly
• Your expertise will drive improvements in the security posture of our products, platforms, and operations
• About the Team - The Security Team at Instacart is focused on protecting our customers, shoppers, partners, and employees while supporting the company’s mission to create a world where everyone has access to the food they love
• Our Red Team emulates adversaries to uncover weaknesses proactively and improve system-wide resilience
• You'll work in a collaborative, fast-paced environment where security innovation and collaboration are central to our success
• Design and execute comprehensive red team operations targeting Instacart's unique attack surface (mobile apps, web platform, logistics systems, payment processing, customer/shopper data)
• Develop annual red team roadmap aligned with business priorities and emerging threats to e-commerce platforms
• Collaborate with leadership to prioritize high-value targets and realistic threat scenarios
• Present findings and strategic recommendations to executive leadership
• Lead complex red team engagements simulating advanced persistent threats and organized cybercrime groups
• Conduct adversary emulation exercises based on threat intelligence relevant to retail, fintech, and logistics sectors
• Test security controls across cloud infrastructure (AWS/GCP), mobile applications (iOS/Android), APIs, and internal networks
• Execute social engineering campaigns against employees, shoppers, and corporate functions
• Develop custom tooling, exploits, and tradecraft specific to Instacart's technology stack