Manager, Offensive Security

We need to output HTML fragment with sections: About the role? Actually the posting includes "About SiTime" (company description) then "Job Summary", "Responsibilities", "Qualifications & Requirements", "Desired Characteristics & Attributes", "Compensation Range". Also maybe "Benefits" not present. "Pay" is present as "Compensation Range". "Schedule" not present. So we should include sections for headings that have real content: About the role? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We should not repeat the job title as a heading. The posting has "Job Summary" which could be considered "About the role". We'll map "Job Summary" to

About the role

. Then Responsibilities, Qualifications & Requirements (maybe combine as Requirements), Desired Characteristics & Attributes could be Skills? Or we could make a Skills section. But we need to only include sections when posting has real specific content. We have content for Responsibilities, Qualifications & Requirements, Desired Characteristics & Attributes, Compensation Range (Pay). Also maybe "About SiTime" is company description, not about the role. Could be omitted? The instruction: "use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." So we should include About the role (Job Summary). Responsibilities. Requirements (Qualifications & Requirements). Skills (Desired Characteristics & Attributes). Pay (Compensation Range). Benefits not present, so omit. Schedule not present, omit. We must not include boilerplate like EEO, E-Verify, etc. Also remove navigation, cookie, legal, duplicated lines. Also remove application instructions (none). Also remove "Learn More about SiTime:" etc. Also remove the YouTube links etc. We must preserve all substantive information. So we need to keep the company description? The "About SiTime" paragraph is substantive but not about the role. Should we include it? The instruction says "use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It doesn't say we must include About SiTime. It says "do NOT repeat the job title as a heading (the page already shows it)". It doesn't forbid including company description. But we need to decide where to put it. Could be a

before any heading. The instruction: "Output ONLY the HTML fragment — no /, no markdown code fences." So we can output a series of

and

/

etc. We could start with a

containing the About SiTime description. Then

About the role

with Job Summary content. Then

Responsibilities

with
• ... etc. Then

  Requirements

  with Qualifications & Requirements content (maybe split into
  ). Then

  Skills

  with Desired Characteristics & Attributes content. Then

  Pay

  with Compensation Range content. We must not invent or summarize away detail. Must preserve all substantive information. So we need to copy the text exactly (or close) but we can format into lists. We need to remove boilerplate: "SiTime is an Equal Opportunity Employer ..." and "SiTime participates in the E-Verify program." Also "Learn More about SiTime: Review the Get to Know SiTime section..." and the YouTube links. Also the repeated lines like "For more information, visit: www.sitime.com ." That's part of About SiTime; we should keep that? It's substantive? It's a link; we can keep as plain text. We also need to remove duplicated lines: there may be none. Now let's extract content. About SiTime paragraph: "SiTime is the Precision Timing company. Timing is the heartbeat of all electronics, ensuring performance, resilience and scalability. For decades, quartz devices, non-silicon technology, have kept systems in sync, but they struggle in harsher, more demanding environments. MEMS-based Precision Timing delivers greater accuracy, smaller size and resilience. Today, MEMS timing powers over 400 applications, including high-growth ones in AI datacenters, automated driving, industrial and humanoid robots, wearables and IoT. Our semiconductor MEMS programmable solutions offer a rich feature set that enables customers to differentiate their products with higher performance, smaller size, lower power, and better reliability. With more than 4 billion devices shipped, SiTime is changing the timing industry. For more information, visit: www.sitime.com ." We'll keep that as a

  . Job Summary paragraph: "Reporting to the CISO, this role leads SiTime's Offensive Security function. It owns penetration testing, red and purple team exercises, vulnerability disclosure and bug bounty, and validation that the controls SiTime has bought and built actually work. This is a build role. The candidate will design a recurring testing program that covers the enterprise, cloud, SaaS, application and laboratory estates, establish adversary simulation against realistic objectives, and create the feedback loop that turns findings into improved detection and hardening rather than a report that is filed away. It is also a people-leadership role. The candidate starts hands-on, personally running the first cycle of testing, then scales through a mix of full-time testers and specialist firms engaged where independence or niche capability is required. This is an accountable owner role, not an advisory one. Findings are owned through to verified closure in partnership with Security Engineering, Vulnerability Management and Security Operations, Security Architecture, IT and Engineering. We value diverse experiences, perspectives, and career paths, and welcome candidates who are excited to contribute to our mission." We'll put that as

  under About the role. Responsibilities: there are three subsections: Offensive Testing Program, Red Team, Purple Team and Detection Validation, Disclosure, Bug Bounty and Program Scaling. Each has bullet-like paragraphs. We'll convert each sentence into

  • items under a
    . Could group under each subheading? But we only have

    for main sections; we could keep subheadings as or just include in list items. The instruction didn't forbid using other tags inside. We'll just make a flat list preserving details. Let's list responsibilities: Offensive Testing Program: - Run a recurring penetration testing program across enterprise, cloud, SaaS, application, network and laboratory environments, covering both grey box and black box engagements. - Scope, plan and execute internal testing, and manage external testing firms where specialist capability or independence is required. - Prioritize testing around the paths that reach design data, source code repositories, laboratory and test networks, and partner and OSAT connectivity. - Own the finding lifecycle end to end: severity, named owner, remediation service level, retest and closure with evidence. - Move the program from point-in-time assessment toward continuous validation of the controls that matter most. Red Team, Purple Team and Detection Validation: - Design and run threat-informed red team exercises against realistic objectives, with clear rules of engagement and authorization. - Run purple team exercises jointly with Security Operations to validate and improve detection coverage, mapping results to MITRE ATT&CK. - Validate that deployed controls detect and prevent, and route the gaps to Security Engineering and Security Operations with reproducible evidence. - Simulate insider and data exfiltration scenarios to test data loss prevention, access controls and monitoring on the design environment. - Contribute technical injections and scenarios to ransomware and crisis tabletop exercises. - Track adversary tradecraft relevant to semiconductors, hardware and intellectual property theft, including state-linked activity, and translate it into test scenarios. Disclosure, Bug Bounty and Program Scaling: - Stand up and run vulnerability disclosure and bug bounty programs, including scope definition, triage, reward policy and researcher relations. - Define the rules, authorization and safety controls that keep offensive activity inside agreed boundaries and out of production impact. - Build the internal testing capability over time, and manage the specialist firms that supplement it. - Support customer-facing security assurance by providing independent evidence of testing coverage and remediation. - Feed recurring themes back into the security roadmap, architecture standards and awareness content. Now Qualifications & Requirements: "6+ years in offensive security, penetration testing or red teaming, including 2+ years leading a program or a team. Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field — or equivalent practical experience. At least one of the following certifications: OSCP, OSEP, OSCE, , or equivalent. Demonstrated hands-on exploitation capability across network, cloud, application, identity and endpoint. Experience designing and running red and purple team exercises and mapping coverage to MITRE ATT&CK. Experience managing external testing vendors and running a vulnerability disclosure or bug bounty program. Ability to write findings that engineers can act on and executives can understand. People leadership or technical lead experience. English proficiency is required, including the ability to effectively communicate, collaborate, and perform job responsibilities in a professional business environment." Note there is a stray comma after OSCE, maybe a typo. We'll keep as is. We'll make each line a

    . Preferred experience etc? Actually after Qualifications & Requirements there is "Preferred Experience in a semiconductor, hardware, embedded or OT-adjacent environment. Hardware and firmware testing experience, including secure boot and debug interface exposure. Cloud exploitation and identity attack path analysis in Azure and AWS. Source code review and application security testing capability. Experience testing engineering, design or laboratory environments without disrupting them." This is still part of Qualifications & Requirements? It appears after the bullet list but before Desired Characteristics. It could be considered "Preferred Experience". We could include them as part of Requirements (maybe as additional

    ). The instruction: "Preserve ALL substantive information". So we should include them. We'll treat them as part of Requirements (maybe as

    under Requirements). We'll keep them. Then Desired Characteristics & Attributes: "Strong ethics and judgment: operates within authorization, documents everything, and knows when to stop. Evidence-driven and measured on risk reduced and detections improved Constructive with the teams being tested; builds partnership rather than an adversarial dynamic. Able to work effectively with a U.S.-based CISO and U.S. stakeholders across time zones." We'll make each as

    under Skills. Compensation Range: "At SiTime, we believe great work deserves great rewards. We offer a comprehensive and highly competitive compensation package designed to attract top talent. In addition to base salary, this role is eligible for a quarterly bonus tied to the achievement of innovation goals—reflecting our commitment to recognizing meaningful impact. We also offer equity grants, providing a meaningful opportunity to share in the company’s future growth and success." We'll put as

    under Pay. Now we need to remove boilerplate: EEO statement, E-Verify, Learn More, YouTube links. Also remove "SiTime is an Equal Opportunity Employer . We treat each person fairly and we do not tolerate discrimination or harassment against anyone on the basis of any protected characteristics, including race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, pregnancy, political affiliation, protected veteran status, protected genetic information, or marital status or other characteristics protected by law. SiTime participates in the E-Verify program." Also remove "Learn More about SiTime: Review the Get to Know SiTime section of our career page to explore our culture, values, and what makes us unique. Innovation on Top – Philosophies of Innovation with Rajesh Vashist Fabrication Knowledge – An Interview with Rajesh Vashist SiTime Corporation – YouTube". Also maybe remove the line "For more information, visit: www.sitime.com ." That's part of About SiTime; we keep it. Now produce HTML. We'll start with

    About SiTime...

    Then

    About the role

    Job Summary...

    Then

    Responsibilities

    ...