Distinguished Red Team Operator

Description

The company Cyber Security (VCS) organization protects assets and information across the company networks, infrastructure and applications. It manages cybersecurity governance, policies, technologies and operations, and builds security into the design of technology systems and services.

The team is hiring a Distinguished Red Team Operator for the Enterprise Red Team. The role leads and takes part in objective-based red team campaigns that test, measure and improve people, processes and technology across many types of targets.

You will turn weaknesses found in environments, applications, systems and processes into realistic real-world attack strategies.

Responsibilities

• Lead and carry out full-spectrum Red Team engagements, including adversary emulation, social engineering, and developing ways to evade EDR and other controls.
• Take in cyber threat intelligence and turn it into realistic, procedure-level emulation plans mapped to the MITRE ATT&CK framework.
• Design, build and maintain custom offensive tools, scripts and methods that expand what the VCS Red Team can cover and how efficiently it works.
• Turn broad strategic goals into concrete plans in complex, unclear environments, with little supervision.
• Lead cross-functional security initiatives, set operating principles, and drive major goals that affect several business areas.
• Configure and deploy advanced attacker TTPs in live environments so testing is rigorous without disrupting business continuity.
• Mentor team members on offensive campaigns, vulnerability analysis, OPSEC and professional growth.
• Serve as the primary subject matter expert on vulnerability impact ratings, advising on how severe specific exposures are and what they imply.
• Explain complex risk scenarios to technical staff, executives and legal counsel, covering both the technical findings and their strategic impact.
• Write high-level documents and presentations that connect detailed exploitation findings to executive risk decisions.
• Give practical, actionable remediation advice that helps the organization rank fixes by realistic risk rather than theoretical severity.

Requirements

• You need a bachelor's degree or four or more years of work experience.
• You need eight or more years of relevant experience, which can come from job work, military service, or specialized non-collegiate training or education, or a mix of these.
• You need six or more years of direct offensive security experience, including leading engagements in adversary emulation, adversary simulation, threat emulation or threat simulation.
• Even better if you have one or more of the following: working knowledge of modern exploitation such as buffer overflows, heap spraying, ROP chains and logic flaws.
• Even better if you know operating system internals on Windows, Linux or macOS, including memory management, process injection, API hooking and kernel structures.
• Even better if you have a proven record of changing TTPs to evade EDR, NDR and XDR tools and to bypass controls such as AMSI and ETW.
• Even better if you are advanced at reading and changing code in C, C/C++, Go or Java for exploit development and custom tooling.
• Even better if you understand network protocols well enough to design covert command-and-control channels that blend in with legitimate traffic.
• Even better if you have expertise in Active Directory and Azure AD attacks, including Kerberoasting, DCSync, Golden Ticket and identity federation exploits.
• Even better if you understand cloud-native environments, especially containers (Docker, Kubernetes) and major clouds (AWS, Azure, GCP).
• Even better if you hold advanced certifications such as OSEP, OSED, GXPN, CRTO, or OSCP/OSWE.
• Even better if you keep growing through CTFs, open-source security tool contributions, or speaking at industry conferences.
• Even better if you know Blue Team processes and tools, including SIEM logic, threat hunting and SOC triage, to simulate realistic threats and give useful feedback.
• Even better if you are proficient in scripting and automation with Python, Bash or PowerShell to build offensive tools and bypass controls.
• Even better if you have a degree in a technical field.
• You do not need to meet every 'even better' item to apply.

Conditions

This is a hybrid role with a defined work location that includes working from home and at least three days per week in the office. Your manager sets the office schedule.

You are responsible for following the hybrid work policies.

The scheduled work week is 40 hours.

Pay depends on your location and on your confirmed job-related skills and experience. The role is incentive based, with potential to earn more.

For part-time roles, pay is adjusted to match your hours.

The annual full-time salary range for the listed location(s) is $137,000.00 - $263,000.00.

Benefits

• Health and wellness options include medical, dental and vision cover, short and long term disability, basic and supplemental life insurance, AD&D insurance, identity theft protection, pet insurance, and group home and auto insurance.
• A 401(k) savings plan with company match.
• Up to 8 company-paid holidays and up to 6 personal days per year.
• Paid parental leave, adoption assistance and tuition assistance, plus other incentives.
• Depending on the role, you may receive premium pay such as overtime, shift differential, holiday pay and allowances.
• New hires receive up to 15 days of vacation per year, and this grows with service.
• Part-time employees may qualify for some of these benefits, depending on their individual circumstances.