Deloitte Global, Senior Red Team Operator

Description

The team builds and improves Red Team capabilities, including those aimed at agentic applications, using AI and AI-driven code development.

The role leads a small group of Red Team Operators who plan, run, and report on engagements worldwide.

The company is the world's largest consulting organization, and this team sits within its global technology function.

Certifications such as OSCP, OSEP, OSED, OSEE, CRTP, and CRTE are preferred, not required.

Responsibilities

• Build and refine Red Team capabilities, including for agentic applications, by applying AI and AI code development skills.
• Lead a small team of Red Team Operators through planning, execution, and reporting on engagements around the globe.
• Make sure every engagement stays within the Rules of Engagement at each stage.
• Work closely with the Red Team Manager to keep improving and developing the team.
• Lead planning, execution, and reporting for red team campaigns, or take on that work directly.
• Gather open-source intelligence on target networks, people, and technologies.
• Find creative ways to gain an initial foothold in a target network.
• Deliver payloads and set up command and control.
• Move through target networks quietly to meet campaign goals without being detected.
• Establish persistence, and tune long-haul beacons to keep footholds where needed.
• Help manage the Red Team Attack Network and bring in new tools and techniques to raise the team's tradecraft.
• Share research with the Deloitte Global Red Team community and the wider security organization through blogs, conference talks, or published code.
• Write operational processes, field manuals, and attack methodologies that improve engagement quality and knowledge sharing across the team.
• Make sure deliverables are high quality, since a campaign is only as good as its report.

Requirements

• Deep knowledge of AI technologies, including AI code development and generative AI offensive security assessments.
• A strong interest in offensive security and Red Team work, and a drive to keep up with current attack techniques, public breaches, and new vulnerabilities.
• At least two years of Red Team experience.
• Experience running open-source intelligence gathering on companies and their people, networks, and technologies.
• Experience with Windows, Azure Active Directory, WMI, and WinRM, and the ability to script or program in PowerShell, C, C++, Python, Go, Nim, and Bash for offensive work.
• Experience designing, building, maintaining, and using covert C2 infrastructure across cloud platforms and environments. Automation experience is a plus.
• Hands-on experience with tools such as Cobalt Strike, Nighthawk C2, GoPhish, Bloodhound, Impacket, Mimikatz, Kekeo, Rubeus, socat, and the Windows Sysinternals suite.
• Experience with modern payload obfuscation techniques.
• Strong technical communication skills and fluent written and spoken English, the team's primary language.
• Self-motivated, and comfortable with time and resources set aside for research or development work.

Conditions

Equal opportunity applies. The company does not discriminate on protected characteristics.