Security Engineer II (Offensive Operations)

We need to output HTML fragment with sections for headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. Must not include Job ID etc. Remove boilerplate, EEO, application instructions, etc. We need to parse the posting. Content: Intro: "Are you ready to trade your job for a journey? Become a FlyMate! Passion, excitement & global collaboration are all core to what it means to be a FlyMate. At Flywire, we’re on a mission to deliver the world’s most important and complex payments. We use our Flywire Advantage - the combination of our next-gen payments platform, proprietary payment network and vertical specific software, to help our clients get paid, and help their customers pay with ease - no matter where they are in the world. What more do we need to truly be unstoppable? Perhaps, that is you! Who we are: Flywire is a global payments enablement and software company, founded more than a decade ago to solve high-stakes, high-value payments in higher education. We’ve since scaled into new regions and industry verticals and expanded our product offerings to deliver meaningful value to our clients around the world. Today we support more than 5,300 clients across the global education, healthcare, travel & B2B industries, with diverse payment methods across 240 countries & territories and more than 140 currencies. With over 1,400 global FlyMates, representing more than 40 nationalities, and in 15 offices world-wide, we’re looking for FlyMates to join the next stage of our journey as we continue to grow." That's about the company, could be "About the role" or maybe "About the company". The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content. Job Description paragraph: "Do you spend your free time figuring out how systems break? Are you driven by the thrill of discovering complex vulnerabilities before malicious actors do? If you’re a natural tinkerer who loves attacking systems to make them unshakeable, this role is built for you. As a Security Engineer II on our Active Operational Offensive track, you’ll sit at the heart of Flywire’s security defenses under the guidance of senior engineers. You will bridge manual penetration testing with active security operations, building the technical depth needed to lead independent engagements over time." That's about the role. Key Responsibilities & Impact: list bullet points. Qualifications: "Here’s What We’re Looking For:" then subpoints: Education & Experience, Hands-on PenTesting, Offensive Toolset, Code & Automation, Modern Stack Exposure, Security Frameworks, High-Impact Communication, Preferred Certifications (Nice-to-Have), Mindset & Soft Skills. Additional Information: includes salary range and benefits mention, and some process description. We need to extract substantive info. We should not include boilerplate like EEO, equal opportunity, application instructions like "Submit today and get started! We are excited to get to know you! Throughout our process you can expect to meet different FlyMates including the Hiring Manager and other Flymates. Your Talent Acquisition Partner will walk you through the steps and be your “go-to” person for questions." That's application instructions; we should remove. Also remove "Flywire is an equal opportunity employer..." etc. We need to keep salary range and benefits mention: "The US base salary range for this full-time position is $99,000 - 120,000 and benefits." Also mention that salary ranges determined by role etc. That's pay info. So we should include a Pay section with that detail. Benefits: they said "and benefits" but not detailed; we might not create Benefits section unless specific benefits listed. Since only "and benefits" vague, maybe we should not create Benefits section because it's not specific. The instruction: never create Pay/Schedule/Benefits sections unless the posting actually states them. It states salary range and mentions benefits but not detail. For Pay we have specifics: salary range. So we include Pay. Benefits: only mention "and benefits" without detail; that's not specific enough; better to omit Benefits section. Schedule: not mentioned; omit. Skills: we could extract from qualifications: maybe combine into Skills section? But we have Qualifications heading already. The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We can have both Qualifications and Skills if content distinct. However qualifications already includes many skill-like items. Could treat Qualifications as the section for education/experience and certifications, and Skills for technical skills. But we need to avoid duplication. Perhaps better to have Qualifications section covering education/experience and preferred certifications, and Skills section covering technical proficiencies (tools, languages, frameworks). Let's see. From qualifications list: - Education & Experience: Bachelor of Science and at least 2+ years’ experience in IT security and Penetration Testing. - Hands-on PenTesting: Demonstrated track record executing network, web application, and API penetration tests. - Offensive Toolset: Proficiency with Kali Linux, commercial/open-source penetration tools, and active involvement on bug bounty platforms. - Code & Automation: Experience with SAST/DAST tools, secure code reviews, and scripting knowledge in Python, Java, or Ruby. - Modern Stack Exposure: Understanding of AWS Cloud infrastructure, Agile environments, CI/CD pipelines, and Infrastructure as Code (IaC). - Security Frameworks: Strong knowledge of OWASP methodologies, threat vectors (malware, intrusion, DoS), and platform security strategies. - High-Impact Communication: Ability to write formal/informal technical reports and translate complex exploit chains to non-technical stakeholders. - Preferred Certifications (Nice-to-Have): Offensive & Red Team: OSCP, OSCE, or SANS GXPN. AI Security: OffSec OSAI (Offensive Security AI Red Teamer). - Mindset & Soft Skills: Dual Focus: Combines an attacker’s drive to break systems with a defender's discipline to build actionable SIEM detection rules. Composure Under Pressure: Analytical and calm during live security breaches or tight release windows. Business-Minded Security: Balances risk mitigation with organizational growth. We could split: Qualifications: Education & Experience, Preferred Certifications, Mindset & Soft Skills (maybe as soft skills). Skills: Hands-on PenTesting, Offensive Toolset, Code & Automation, Modern Stack Exposure, Security Frameworks, High-Impact Communication. But the instruction says prefer a few substantive sections over many thin ones. Could combine all into Qualifications. But we have also Responsibilities section. We need About the role: we have intro about role and company description. Could be About the role. Responsibilities: list from Key Responsibilities & Impact. Qualifications: maybe combine education/experience, certifications, mindset. Skills: maybe not needed if we put everything in Qualifications. But we need to follow headings list; we can omit Skills if no specific content beyond what's in Qualifications. However we have technical skills content; could be placed under Qualifications. That's acceptable. Thus sections: About the role, Responsibilities, Qualifications, Pay. We must not include Schedule, Benefits, Skills if not specific. Now craft HTML. Use

for each section heading. Inside each section, use

for prose,

• for lists. We need to preserve all substantive information; do not invent or summarize away detail. Let's extract About the role content: combine the introductory paragraphs about FlyMate passion, mission, company description, and the role description paragraph. We need to avoid repeating job title (Security Engineer II) maybe it's okay to include in prose but not as heading. We'll produce:

  About the role

  Are you ready to trade your job for a journey? Become a FlyMate! Passion, excitement & global collaboration are all core to what it means to be a FlyMate. At Flywire, we’re on a mission to deliver the world’s most important and complex payments. We use our Flywire Advantage - the combination of our next-gen payments platform, proprietary payment network and vertical specific software, to help our clients get paid, and help their customers pay with ease - no matter where they are in the world. What more do we need to truly be unstoppable? Perhaps, that is you! Who we are: Flywire is a global payments enablement and software company, founded more than a decade ago to solve high-stakes, high-value payments in higher education. We’ve since scaled into new regions and industry verticals and expanded our product offerings to deliver meaningful value to our clients around the world. Today we support more than 5,300 clients across the global education, healthcare, travel & B2B industries, with diverse payment methods across 240 countries & territories and more than 140 currencies. With over 1,400 global FlyMates, representing more than 40 nationalities, and in 15 offices world-wide, we’re looking for FlyMates to join the next stage of our journey as we continue to grow.

  Do you spend your free time figuring out how systems break? Are you driven by the thrill of discovering complex vulnerabilities before malicious actors do? If you’re a natural tinkerer who loves attacking systems to make them unshakeable, this role is built for you. As a Security Engineer II on our Active Operational Offensive track, you’ll sit at the heart of Flywire’s security defenses under the guidance of senior engineers. You will bridge manual penetration testing with active security operations, building the technical depth needed to lead independent engagements over time.

  That seems fine. Responsibilities: list bullet points from Key Responsibilities & Impact. We need to preserve each bullet exactly as given. Let's list: - Cloud Infrastructure PenTesting: Execute manual internal and external penetration testing across AWS/multicloud environments to identify vulnerabilities, misconfigurations, and privilege escalation paths. - Web Application & API Assessment: Perform deep-dive testing on web applications and REST/GraphQL APIs, targeting complex business logic flaws, auth bypasses, and OWASP Top 10 risks. - Source Code & Vulnerability Analysis: Review SAST/DAST findings and conduct targeted code audits (Python, Java, Ruby) to eliminate false positives and prioritize high-risk fixes. - Purple Team Operations: Partner with the Blue Team during adversary emulation exercises to validate security controls, refine enterprise SIEM detection rules, and optimize real-time alerting. - Red Team Engagements: Participate in goal-oriented adversarial simulations evaluating Flywire’s physical/digital posture and incident response readiness. - Bug Bounty Operations: Manage external vulnerability disclosure and bug bounty programs, triaging submissions, validating severity, and coordinating swift engineering fixes. - Threat Intelligence (MITRE ATT&CK): Apply emerging threat actor TTPs to continuously align testing methodologies with the MITRE ATT&CK framework. - Collaborative Advisory: Deliver actionable remediation guidance to Engineering, SRE, and IT teams, balancing robust security fixes with business velocity. We'll put each as
• . Qualifications: we need to include Education & Experience, Hands-on PenTesting, Offensive Toolset, Code & Automation, Modern Stack Exposure, Security Frameworks, High-Impact Communication, Preferred Certifications, Mindset & Soft Skills. We could keep as list items with subheadings? But we must use
  • for any list of duties/requirements/benefits. So we can make each qualification as
  • with the bold heading inside? The original had headings like "Education & Experience:" etc. We can keep them as part of the
  • text. Thus:
    • Education & Experience: Bachelor of Science and at least 2+ years’ experience in IT security and Penetration Testing.
    • Hands-on PenTesting: Demonstrated track record executing network, web application, and API penetration tests.
    • Offensive Toolset: Proficiency with Kali Linux, commercial/open-source penetration tools, and active involvement on bug bounty platforms.
    • Code & Automation: