--- title: 'Senior Offensive Security Engineer - Internal Audit at McMaster-Carr' canonical: 'https://feeny.ai/job/senior-offensive-security-engineer-internal-audit-mcmaster-carr-chicago-s55y9tenwn8r' type: 'job' last_seen: '2026-09-13' --- # Senior Offensive Security Engineer - Internal Audit at McMaster-Carr - **Company:** McMaster-Carr - **Location:** Chicago, IL - **Posted:** 2026-09-10 - **Last confirmed live:** 2026-09-13 - **Apply:** https://job-boards.greenhouse.io/mcmastercarr/jobs/4402186009 ## Job description ## Who We Are McMaster-Carr is a leading e-commerce company that industrial customers have trusted for 125 years. Our products help them get manufacturing lines back up quickly, keep operations running smoothly, and prototype the next generation of innovative solutions. We earn and keep that trust by offering the right products, making them easy to find, and delivering them fast, so customers can solve problems with greater speed, precision, and ease. Our industry-leading e-commerce experience, indispensable product selection, and world-class service bring hundreds of thousands of customers to mcmaster.com each day. But we're never standing still. Curious, exceptional people are at the heart of our evolution. They turn new challenges and disruptive technologies into opportunities to refine our operations, expand our offering, and deliver a better experience for every customer. ## What you will do McMaster-Carr is seeking a Senior Offensive Security Engineer to build and operate an independent security assurance capability within Internal Audit. Using penetration testing, adversary emulation, and purple-team techniques, you will evaluate whether our cybersecurity controls work as intended against realistic scenarios. This is not a conventional penetration-testing role focused only on finding vulnerabilities. As a member of McMaster-Carr’s Internal Audit team, your work will help determine whether controls prevent attacks, whether monitoring produces meaningful alerts, whether response processes work, and where security investments should be strengthened. You will translate technical findings into practical risk insight and solutions for Information Security, business leaders, executive management, and the Audit Committee. Work is independent yet collaborative with strong governance. You will partner closely with Information Security while remaining organizationally independent from the teams responsible for designing and operating the controls you assess. - Design and execute risk-based penetration tests, assumed-breach exercises, adversary simulations, and purple-team engagements across enterprise systems, applications, networks, identity platforms, and cloud environments. - Test whether preventive, detective, and responsive security controls perform as expected under realistic attack Evaluate attack paths, control weaknesses, detection coverage, alert quality, and the effectiveness of incident-response procedures. - Collaborate with Security Operations and other technical teams during purple-team exercises to validate detection and response - Develop test plans, objectives, techniques, targets, safeguards, and rules of engagement for management approval before execution. - Translate technical findings into risk-based remediation recommendations that help leaders of technical teams, Internal Audit leadership, executive management and the Audit Committee prioritize security improvements and - Build a repeatable, continuously improving offensive-security assurance program informed by a growing understanding of our environment. - Partner with external security firms when specialist expertise or independent corroboration is ## Who You Are We are seeking bright, curious, and ambitious individuals eager to make an impact. Ideal candidates have: - 5+ years of relevant offensive security experience, including at least three recent years conducting penetration tests, red team engagements adversary emulation exercises, or purple team assessments in complex military or civilian environments. - A four-year college degree - Demonstrated ability to independently scope, plan, execute, document, and clearly communicate technically sophisticated security assessments to both engineering and executive-level audiences. - Broad knowledge of enterprise attack surfaces, including hands-on experience with several of the following domains: identity systems (LDAP, IAM), operating systems (Windows and Linux), network infrastructure, cloud platforms, web applications and APIs, endpoint systems, and security monitoring tools. - Practical experience identifying and validating exploitable attack chains, bypassing or testing security controls, and determining whether detection and response mechanisms function as intended. - Strong scripting or automation skills and the ability to adapt tools and techniques to assess unfamiliar environments effectively. - Ability to operate safely and effectively in production-sensitive environments while maintaining strict adherence to rules of engagement and approved scope. - Sound judgment, discretion, and a disciplined approach to handling privileged information and sensitive findings. - Excellent written and verbal communication skills that translate technical weaknesses into clear business impact and remediation priorities for both engineers and senior leaders. - A collaborative style that builds trust with Security and Systems teams while maintaining the objectivity required of an independent assurance function. - A track record of taking initiative, identifying high-impact areas for investigation, and driving work through remediation and retesting. ## Compensation Total cash compensation generally ranges from $170,000-$250,000 and includes profit sharing based on company performance. Growth & Learning - 100% tuition reimbursement - Informal and formal mentorship - Employee resource groups Health & Wellbeing - Medical, dental, pharmacy and vision plans without monthly premiums - Inclusive, all-gender benefits Family & Future - Paid parental leave for all new parents - Adoption and surrogacy assistance - First-time home buyer assistance - Industry-leading company-funded retirement accounts Time Off - Paid vacation and personal time ## Equal Opportunity Employer We are proud to be an Equal Opportunity Employer and dedicated to providing employees a workplace with reasonable accommodations and free of discrimination, harassment, and retaliation. At McMaster-Carr, we do not make employment decisions based on age, ethnicity, citizenship status, military status, gender identity and expression, race, religion, disability status, marital status, sexual orientation, or any other legally protected group. This position is not eligible for work authorization sponsorship by McMaster-Carr. Data We Collect We may collect professional, education and employment-related data, and any assessments made throughout the recruiting process, to evaluate candidacy for employment. To communicate with job applicants, we may collect applicant names, contact information, and other personal identifiers, including those outlined in the California customer records statute. Through voluntary disclosure, we may also collect protected classifications under federal or California law (e.g., race, gender, etc.). For additional details about the personal information we collect and its uses, please click [here](https://www.mcmaster.com/cpra_job_applicant_notification/). ## About McMaster-Carr ## Company Overview - **One-liner**: McMaster-Carr is a privately held e-commerce and catalog company that supplies over 600,000 industrial products to businesses for maintenance, repair, and operations (MRO). - **Entity Type**: Private (family-owned, bootstrapped) - **Headquarters**: Elmhurst, Illinois, USA - **Founded**: 1901 - **Founders**: Not publicly disclosed (family‑owned business) ## Core Business - **Primary industry**: Industrial supplies & equipment distribution (MRO) - **Target customers**: B2B – engineers, maintenance teams, purchasing agents, and manufacturing/construction firms (small businesses to large enterprises) - **Mission / purpose**: To be the complete, one‑stop source for industrial supplies, delivering high‑quality products with fast, reliable service. (Paraphrased from the company’s stated focus on “handpick[ing] every product” and shipping 98% of orders from stock the same day.) ## Products & Services - **Industrial Supply Catalog**: Over 600,000 SKUs covering fasteners, raw materials, plumbing, electrical, safety equipment, precision tools, and more. Offered as a SaaS‑like web platform with CAD downloads, material certificates, and 3D models. - **Same‑Day / Next‑Day Delivery**: 98% of orders ship from stock at standard rates, with same‑day or next‑day delivery to many U.S. locations. - **In‑House Software & Technology**: Custom‑built e‑commerce engine, inventory management, distribution automation, and mobile applications developed by internal engineering teams. ## Market Standing - **Valuation / Market Cap**: Not disclosed (private company) - **Key Metric**: Annual revenue is not publicly reported; industry estimates often place it in the $3–5 billion range, but the company does not confirm figures. - **Notable Investors**: None (family‑owned; no external funding raised) - **Growth Signals**: - Active hiring across six U.S. facilities (Chicago, Atlanta, Cleveland, Los Angeles, Princeton, Fort Worth) for roles in software engineering, distribution automation, customer solutions, and management. - Expanding its technology team with focus on automation, data centers, and mobile app development. - Recently posted openings for “Automation Engineering Manager” and “CMMS Engineer,” indicating investment in warehouse and process automation. ## Competitive Advantages - **Massive Catalog & Fast Fulfillment**: Unmatched breadth of inventory (600k+ products) combined with near‑universal in‑stock availability and same‑day shipping—a difficult combination for competitors to replicate. - **In‑House Technology**: All software (e‑commerce, distribution, logistics) is built and maintained internally, giving McMaster‑Carr tight integration and the ability to rapidly iterate. - **Strong Supplier Relationships & Quality Control**: Products are hand‑picked and verified; material certificates and traceability are standard. - **Engineering‑First Culture**: Technology teams are highly autonomous and work on challenging projects (warehouse robotics, high‑performance web apps, data center design). ## Strategic Focus - **Automation & Distribution Efficiency**: Investing heavily in automated material handling, robotics, and facility reliability to maintain speed and accuracy as order volumes grow. - **Technology Talent Development**: Growing the software engineering and IT teams to support custom development of internal tools, customer‑facing platforms, and infrastructure. - **Geographic Expansion**: Operations centers in five major U.S. regions (plus the Chicago HQ) to provide fast delivery nationwide; newer facilities in Fort Worth and Princeton signal continued geographic scaling. ## Why Work Here - **Culture & Values**: Emphasizes “capability, not skill”—hiring curious people who can grow across roles. Strong inclusion and diversity programs, prayer/meditation spaces, all‑gender restrooms, mentoring groups. - **Work Model**: Hybrid for many tech roles (typically 3 days on‑site per week); distribution and customer‑facing roles are generally on‑site. Remote flexibility varies by position. - **Compensation & Benefits**: - No‑monthly‑premium medical, dental, pharmacy, and vision plans for employees and dependents. - Generous profit sharing and company‑funded retirement accounts. - 100% tuition reimbursement, adoption/surrogacy assistance, paid parental leave. - First‑time home‑buyer assistance, financial counselors, and college assistance for dependents. - **Engineering Culture**: Engineers work on diverse projects (web, mobile, data centers, automation) with support for learning through reading groups, guilds, and technical leadership tracks. ## Sources 1. [mcmaster.com/careers](https://www.mcmaster.com/careers) 2. [mcmaster.com](https://www.mcmaster.com/) 3. [builtin.com/company/mcmaster-carr](https://builtin.com/company/mcmaster-carr) 4. [job-boards.greenhouse.io/mcmastercarr](https://job-boards.greenhouse.io/mcmastercarr/jobs/4088048009) ## Other roles at McMaster-Carr - [IT Operations Technician](https://feeny.ai/job/it-operations-technician-mcmaster-carr-elmhurst-jameh4az266p) — Elmhurst, IL - [MBA Summer Internship: Leadership, Strategy, & Operations - Products & Publishing (MBA Class of 2028)](https://feeny.ai/job/mba-summer-internship-leadership-strategy-operations-products-publishing-mba-jx2nszvkp8w5) — Chicago, IL - [Senior Manager, Reliability & Platform Engineering](https://feeny.ai/job/senior-manager-reliability-platform-engineering-mcmaster-carr-chicago-dcnn17839tj3) — Chicago, IL - [Market Researcher](https://feeny.ai/job/market-researcher-mcmaster-carr-chicago-67x6yzdfk1nh) — Chicago, IL - [Facilities Maintenance Technician](https://feeny.ai/job/facilities-maintenance-technician-mcmaster-carr-chicago-j62b7nv5r2v9) — Chicago, IL - [2027 PhD Management Track](https://feeny.ai/job/2027-phd-management-track-mcmaster-carr-atlanta-c20gyttfjmaw) — Atlanta, GA / Chicago, IL / Cleveland, OH / Fort Worth, TX / Los Angeles, CA / Princeton, NJ - [Leadership, Strategy, & Operations (MBA Class of 2027)](https://feeny.ai/job/leadership-strategy-operations-mba-class-of-2027-mcmaster-carr-atlanta-ymc2a81vrxq0) — Atlanta, GA / Chicago, IL / Cleveland, OH / Fort Worth, TX / Los Angeles, CA / Princeton, NJ - [Technology, Development, & Design](https://feeny.ai/job/technology-development-design-mcmaster-carr-chicago-dkye9xqt0cw7) — Chicago, IL - [Management Track](https://feeny.ai/job/management-track-mcmaster-carr-atlanta-4e9g9tc4xpd1) — Atlanta, GA / Chicago, IL / Cleveland, OH / Fort Worth, TX / Princeton, NJ / Los Angeles, CA - [Market Researcher](https://feeny.ai/job/market-researcher-mcmaster-carr-los-angeles-bfpsqb8d9mg4) — Los Angeles, CA (Santa Fe Springs)