Postman

Postman

Principal Offensive Security Engineer

San Francisco, California, United States · Principal

Sponsorship not specified$275k-$300kDetected 42 days ago
AWSKubernetesCI/CDGraphQLgRPCMachine LearningLLMsRAGAgentic AICybersecurityPenetration TestingSOC OperationsComplianceOKRsSupply ChainPostmanHIPAAResearchLeadershipCommunicationCollaborationMentoringPublic Speaking

Stay score

odds of building a lasting career here

61Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role90
Entry-level history0
PERM / green-card track0
Lottery odds (Level IV)94
Fits your clock70

Sponsors, but it's cap-subject — you still face the weighted lottery (~61% per draw at Level IV). Good if you win; have a cap-exempt backup on your list.

Lottery odds assume a STEM candidate.

Personalize to your clock →

H-1B wage level

the lottery is wage-weighted — each level is one more entry

Level IV · 4×
Level I$87,6511 entry
Level II$123,1782 entries
Level III$158,7253 entries
Level IV$194,2514 entries

This range already reaches Level IV — the maximum four lottery entries.

DOL prevailing wage, 2026-27 wage year · Information Security Analysts (15-1212) · San Francisco-Oakland-Fremont, CA. Wage level is derived by USCIS from the offered wage, occupation and worksite; the occupation shown is inferred from the job title.

Employer immigration record

from this employer's Department of Labor filings

Files H-1B transfers

15 transfer filings in the last year, covering 15 workers. Median labor-condition decision: 8 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • The Information Security organization at Postman operates across three pillars: Governance Risk & Compliance (GRC), Product Security, and Security Operations.
  • We are a team of builders, not checkbox-checkers.
  • We hold active SOC 2 Type II, ISO 27001, ISO 42001, and HIPAA compliance postures, and we are pursuing FedRAMP High and CMMC Level 2 authorization.

Responsibilities

  • Build the Offensive AI Security Practice: Stand up and scale a dedicated offensive capability targeting AI/ML systems.
  • Develop AI Threat Intelligence: Track and operationalize the rapidly evolving AI threat landscape - OWASP LLM Top 10, MITRE ATLAS, emerging attack research on agentic systems - translating external research into internal red team playbooks and detection hypotheses for Security Operations.
  • Lead structured adversarial campaigns against Postman's LLM deployments, AI agents, and model pipelines - targeting prompt injection, tool-use abuse, data exfiltration via context manipulation, training data poisoning, model manipulation, and trust boundary violations in multi-agent architectures.
  • Architect Autonomous Testing: Design and deploy AI-based penetration testing platforms and autonomous agents to perform continuous security validation across our API ecosystem.
  • Lead & Cultivate: Build, manage, and scale a high-performing team of offensive security engineers - including specialized AI red team operators - providing mentorship, career development, and succession planning.
  • Build a pipeline that includes internal development paths for existing security engineers to cross-skill into AI red teaming.
  • Partner with GRC on audit evidence and compliance posture derived from offensive operations, including AI-specific risk frameworks (ISO 42001).
  • Demonstrated experience attacking AI/ML systems - whether through adversarial ML research, LLM red teaming, agentic system exploitation, or building offensive tooling for AI targets.
  • Demonstrated ability to build and scale an offensive security program from the ground up or significantly mature an existing one.
  • Understanding of how to manage non-deterministic AI outputs in both offensive tooling and target systems.

Requirements

  • API Security Depth: Experience with API-specific attack methodologies - BOLA, BFLA, mass assignment, GraphQL abuse, gRPC exploitation - reflecting Postman's core product domain.
  • Hands-on experience with AI-augmented pentesting tools (e.g., PentestGPT, Horizon3, custom LLM-based fuzzing) and purpose-built AI red team frameworks (e.g., Microsoft PyRIT, Garak, custom harnesses).

Compensation

  • The reasonably estimated base salary for this role ranges from $275,000 to $300,000, plus a competitive equity package.

Company info

  • The Information Security organization at Postman operates across three pillars:
  • Governance Risk & Compliance (GRC), Product Security, and Security Operations.
  • Our security stack includes Wiz, SentinelOne, Okta, Jamf, and 1Password, and we operate across a multi-cloud environment.
  • The Offensive Security team is the "red" pulse of this organization.
  • We don't just find bugs - we simulate the adversary to ensure our defenses hold up under real-world pressure.
  • We focus on continuous security validation, AI-augmented adversary emulation, and offensive AI security research at Postman's scale.
  • The Opportunity
  • We are looking for a Principal Offensive Security Engineer who is as much a strategist as they are a hacker.
  • You will own the strategic direction of Postman's offensive security program - including building out a dedicated Offensive AI Security capability from the ground up - and operate as a key partner to CISO leadership on threat-informed defense strategy.
  • This is not a role where you inherit a mature program and keep the lights on.
  • You will shape what offensive security looks like at Postman for the next three years, with a specific mandate to make us an industry leader in adversarial testing of AI systems, agentic workflows, and LLM integrations.
  • You will lead a team that doesn't just "report" vulnerabilities but "demonstrates" them, using live exploits to build a deep, visceral security culture across the entire engineering organization.
Apply directly at Postman →Create a free account for alerts like thisView Postman immigration profile

This listing is sourced directly from Postman's careers page and normalized into a canonical job model.