About the role You will find our weaknesses before someone else does. Unity's attack surface spans the engine and editor that developers build on, the client runtime shipped in games played by billions of people, a broad portfolio of cloud products and services, a large ads and monetization business, our corporate environment, and a fast-growing set of AI-assisted and agentic tools. Your job is to attack all of it the way a real adversary would, and to turn what you find into fixes that stick.
This is not a checklist pen-testing role. You will plan and run realistic attack campaigns, chain small weaknesses into real impact, and explain clearly to engineers and leaders what an attacker could actually do and what matters most to fix. You will work closely with Product Security, Infrastructure Security, Security Operations, and engineering teams, and you will help build the tooling and automation that let a small offensive team cover a very large surface.
What you will own Adversary emulation and red teaming : plan and run objective-based red team operations against our cloud, corporate, and production environments, modeled on threats relevant to Unity. Run purple team exercises with Security Operations to test and improve detection and response. Application testing : deep security testing of Unity products and services, including web applications and APIs, the engine, editor and client runtime, ads and monetization systems, and developer-facing platforms.
Cloud and infrastructu