Senior Security Engineer, Offensive Security & Remediation

Weight Watchers is the global leader in science-backed weight management, offering an integrated support system built for the GLP-1 era that combines scientific expertise, medication, cutting-edge technology, and human connection. With more than 60 years of experience, Weight Watchers is the most studied commercial weight management program in the world, delivered through its No. 1 U.S. doctor-recommended weight-loss program. Its holistic, personalized approach also includes U.S.-based clinical interventions and access to GLP-1 medications when clinically appropriate, and a global network of coaches and community support. Since 1963, the company has led with science to deliver its members the personalized support they need to reach and sustain their goals. Members can access these solutions directly, or through Weight Watchers for Business’ full-spectrum platform for employers, health plans, and payers. In a landscape crowded with contradictory advice, isolating apps, and one-size-fits-all solutions, Weight Watchers offers a proven path forward that is rooted in research, grounded in empathy and designed to help every member feel better in their body and live a longer, healthier life.

ABOUT THE TEAM

WW (WeightWatchers) helps millions of members build healthier habits through science-backed weight management, clinical care and community. Protecting their health and personal data is core to that trust.

Platform Security is moving from a compliance-driven program to an engineering-driven one. We are building detection and response, cloud and application security, supply chain security and identity controls, with a small team that ships real capabilities rather than paperwork.

WHAT YOU'LL DO

We're hiring a Senior Security Engineer who spends most of their time breaking things. You'll run continuous offensive testing against our TypeScript applications, APIs and AWS infrastructure, including new features as they ship to production, using both hands-on techniques and AI agent-driven workflows.

You'll also write fixes. About a third of your time goes to remediation PRs and guardrails that stop bug classes from coming back. As part of the broader product security team, you'll help run and improve our SAST, DAST, SCA, bug bounty and AI-assisted security tooling.

Offensive security (~70%)

• Plan and run red team, purple team and application penetration tests mapped to MITRE ATT&CK, focused on the threats that matter to a consumer health company: account takeover, API abuse, cloud credential misuse and data exfiltration.
• Test our TypeScript web apps and APIs for OWASP Top 10 and API Top 10 issues: broken authorization and IDOR, injection, SSRF, prototype pollution, XSS and insecure deserialization.
• Continuously test new features in production as they ship, under agreed rules of engagement: dedicated test accounts, no access to real member data, rate limits and clear stop conditions.
• Attack our identity stack (OIDC/OAuth, SSO, session handling) to validate that controls hold.
• Build and operate agentic red team workflows: LLM-driven agents for recon, attack-path discovery and continuous testing, under human oversight, with scoped targets, kill switches, audit logging and human approval before high-impact actions.
• Test our own AI features and agents for prompt injection, tool misuse and data leakage.
• Scope, manage and quality-check third-party pentest and red team engagements, from rules of engagement through retest.

Remediation and secure engineering (~30%)

• Write and ship remediation PRs in TypeScript/Node.js and React/Next.js codebases, with tests, following team review and release processes.
• Fix vulnerable npm dependencies safely: upgrades, lockfile hygiene and breaking-change handling.
• Build secure-by-default libraries and patterns (authorization middleware, input validation schemas, safe output encoding, secrets handling) that product teams adopt.
• Turn each finding class into a durable guardrail: a regression test, a custom SAST or lint rule, or a CI check.
• Use AI coding assistants and agents to speed up remediation, with human review on every change.

AWS infrastructure offensive security (stretch)

• Emulate cloud attacks across our AWS accounts: IAM privilege escalation, role-chaining and cross-account trust abuse, exposed credentials and metadata service (IMDS) abuse via SSRF.
• Test external exposure: public S3 buckets, API Gateway and Lambda misconfigurations, CloudFront and load balancer edge cases, and forgotten internet-facing assets.
• Assess EKS and Kubernetes for container escape, pod-to-cloud privilege paths and secrets exposure.
• Map attack paths from application bugs to cloud impact, and hand infrastructure fixes to platform owners with clear reproduction steps.

Product security team and tooling

• Work as part of the broader product security team, sharing priorities, findings and triage duties.
• Help run and tune our existing application security tooling: SAST, DAST and SCA, reducing false positives and routing real issues to owners.
• Triage and validate Bugcrowd submissions, reproduce reports, set severity and work with engineers on fixes and payouts.
• Use and improve Claude Security for AI-assisted vulnerability discovery and patching, checking its findings and fixes against manual testing.
• Report on outcomes: exploitable findings closed, time to remediate against SLA, bug classes eliminated and tooling signal-to-noise.

WHO YOU ARE

• 6+ years in security or software engineering, with 3+ years of hands-on offensive work (pentesting, red or purple team, or application security testing).
• Hands-on offensive experience in AWS: IAM privilege escalation, cross-account and role-trust abuse, SSRF to metadata credentials and misconfigured public services.
• Production software engineering experience in TypeScript and Node.js: you've shipped fixes that went through code review, tests and CI/CD.
• Deep knowledge of web and API vulnerabilities (OWASP Top 10, API Security Top 10) and how to fix them properly in code.
• Experience safely testing live production systems under rules of engagement.
• Working experience with SAST, DAST and SCA tools, including tuning and triaging their output.
• Hands-on experience using or building agentic workflows for offensive security, and a clear view of where they fail.
• Experience with Burp Suite or similar proxies, and scripting custom tooling in TypeScript or Python.
• Solid understanding of OAuth 2.0/OIDC, session management and authorization models.
• Clear writing: findings engineers can act on, and PR descriptions reviewers can trust.

Nice to have

• React/Next.js and a Node.js framework such as NestJS or Express.
• npm supply chain security: SBOMs, provenance, lockfile and install-script risks.
• Writing custom SAST rules (Semgrep-style) or ESLint security rules.
• Experience managing third-party pentest or red team vendors end to end.
• Agent frameworks, MCP servers or tool-calling LLM APIs; knowledge of OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Adversary-emulation tooling (e.g. Atomic Red Team, Caldera) and C2 frameworks.
• Running or triaging a bug bounty program (Bugcrowd or similar), or a personal bug bounty track record or published CVEs. Cloud offensive tooling such as Pacu, CloudFox or Prowler, and AWS certifications (e.g. AWS Security Specialty).
• Experience in regulated environments (HITRUST, SOC 2, CCPA).

At WeightWatchers, our mission is to build a worldwide community connected by healthy habits. If that resonates with you, then we would love to talk. WeightWatchers values developing community within our employee population as well.  We have a hybrid work environment to allow our employees to find the right work-life balance. 

At WW, cultivating a diverse and inclusive workplace is a priority. We are committed as individuals, as an organization, and as fellow humans to advocate for and support our employees, our members, and our communities. We are proud to be an equal opportunity employer and do not discriminate on the basis of sex, race, color, creed, national origin, marital status, age, religion, sexual orientation, gender identity, gender expression, veteran status, or disability.

By agreeing to participate in our process, you agree that any information we collect is subject to our Privacy Policy.

RECRUITMENT SECURITY & FRAUD PREVENTION

At WeightWatchers, we prioritize the security of our candidates. To ensure you are communicating with a legitimate representative of our team, please keep the following security standards in mind:

• Verified Email Domain: All official correspondence from our recruiting team will originate from an @ww.com email address. 
• Live Engagement: Our hiring process requires live interaction. We do not conduct interviews or extend employment offers solely through text message, chat apps, or automated email-only exchanges.
• Financial Integrity: WeightWatchers will never ask for any form of payment from a candidate. We will never send you a check with instructions to purchase equipment or "start-up kits" on our behalf.
• Secure Data Collection: Sensitive personal information (such as banking or identity tax info) is only requested through our official, secure onboarding portal after a formal offer has been extended, never during the interview phase.

Stay Vigilant: If you are contacted by someone claiming to represent WeightWatchers and the process deviates from these standards, please do not share any personal information. You can verify any open position by visiting our official careers page at https://job-boards.greenhouse.io/ww