Responsibilities
- Execute advanced red team and adversary emulation engagements aligned to real-world attacker tactics, objectives, and multi-stage attack chains (including assumed breach scenarios).
- Perform hands-on offensive operations end-to-end (initial access through persistence, privilege escalation, lateral movement, and C2) across hybrid enterprise environments while adhering to rules of engagement.
- Build, maintain, and safely use custom tooling and techniques (scripts, payloads, automation, tradecraft improvements) to simulate realistic adversary behavior and evade controls in a controlled manner.
- Translate offensive findings into defensive improvements by partnering with detection/hunting/IR teams to validate coverage, identify gaps, and deliver clear reporting with actionable recommendations.
Requirements
- 5+ years of red teaming, penetration testing, or offensive security experience with demonstrated impact in modern enterprise environments.
- Strong understanding of attacker tradecraft and TTPs, plus hands-on experience operating across endpoint, identity, cloud, and hybrid infrastructure.
- Working knowledge of defensive tooling and operations (e.g., EDR, SIEM, identity protection, cloud security controls) and experience collaborating in purple team exercises.
- Ability to plan and execute independently within defined scope, paired with high ethical standards, strong documentation/reporting skills, and clear communication.
Preferred / Nice to have
- Threat-intelligence-informed adversary emulation (not only vulnerability-driven testing)
- Proven track record converting red team findings into improved detections or response playbooks
- Scripting/automation (Python, PowerShell, Bash) and familiarity with MITRE ATT&CK
- Experience in regulated or large enterprise environments; mentoring or internal training contributions
