I think Project Zero would count as offensive work in this regard; they are actively trying to find problems in other systems, rather than trying to stop other people trying to find problems in their systems.
But their work is essentially penetration testing and exploit development. That usually counts as offensive side. They are not designing and building secure-by-design stuff, for example.
They are known for breaking stuff, and everyone wants to be the same.
Goal might be defensive in everything cyber security researchers do, but that was not my point.