Principal Red Team Operator

Description

We are a group of engineers, researchers, and security specialists building autonomous proactive security. The aim is to find risk and fix it before an organization is breached, using purpose-built security models and agents that encode how skilled practitioners work.

The company was founded by Kevin Mandia, who also founded Mandiant, which sold to Google for $5.4B. The team includes people from Google, xAI, Meta, Stanford, Georgia Tech, Waterloo, Berkeley, and MIT.

The product is a swarm of specialized AI agents running custom models. They find, exploit, and chain vulnerabilities across external, internal, identity, cloud, and application attack surfaces, continuously and at machine speed, against live production systems. In one recent engagement the swarm ran more than 17 million offensive actions in three days and validated 38 attack paths.

As the principal operator, you will run hands-on operations, then turn your judgment into the reasoning the agents use at scale. That covers choosing a foothold, abusing application logic, pivoting through identity, telling real exploitability from scanner noise, and measuring blast radius. You will test full kill chains end to end, find where the swarm makes naive choices, and use AI in your own work to move faster.

The team is small and high ownership. You will work alongside veteran operators and AI engineers, and the work reaches enterprises through leading industry partners.

Responsibilities

• Lead multi-discipline red team engagements across application security, network penetration testing, cloud, and identity, joining them into focused, high-impact campaigns.
• Find new attack chains and weaknesses that cross traditional security boundaries, combining source code review, network analysis, binary reverse engineering, and infrastructure assessment to surface gaps that matter to the business.
• Write rigorous technical reports and executive briefings that turn offensive findings into remediation plans and risk explanations for technical and non-technical readers.
• Research the threat landscape of enterprise environments, including adversary TTPs, business risk, and compliance impact.
• Share tradecraft, tooling lessons, and takeaways from complex engagements to raise team skill and build the company's offensive security reputation.
• Work with product engineering and AI teams, including onsite, to turn red team needs and adversarial insight into platform features, tool integrations, and AI-driven attack simulations.
• Speak for offensive tradecraft in product strategy, pushing for realistic attack complexity and operator efficiency.
• Lead research into new attack vectors, exploitation methods, AI-assisted adversarial techniques, and tools.
• Build and contribute to open-source tools, internal frameworks, and methods that strengthen the company and the wider security community.
• Represent the company as a technical voice through conference talks, published research, and community engagement.
• Brief executive leadership and client C-suite teams on strategic findings, risk, and business impact.
• Help interview and assess prospective red team operators.

Requirements

• 8+ years of hands-on offensive security experience, with depth in several disciplines.
• Advanced web application testing and secure code review, including OWASP Top 10, business logic flaws, authentication and authorization bypass, API security, and control flow analysis.
• Network penetration testing, Active Directory attacks, lateral movement, privilege escalation, and persistence across enterprise infrastructure.
• Mobile app security, thick and thin client reverse engineering, and binary analysis on iOS, Android, Windows, macOS, and Linux.
• Cloud security, identity systems (Kerberos, SAML, OAuth), and multi-cloud red team operations.
• Proven ability to combine findings across attack surfaces into complete strategic campaigns.
• Expert use of offensive tools such as Burp Suite, OWASP ZAP, Caido, Nmap, Metasploit, Cobalt Strike, Impacket, BloodHound, Responder, CrackMapExec, Frida, Ghidra, IDA Pro, and others.
• Strong scripting and tool building in Python, Bash, PowerShell, or a compiled language, including extending C2 frameworks, writing custom exploits, and building application-specific tools.
• Deep knowledge of network protocols, packet analysis, cryptography, system architecture across Windows, Unix/Linux, and cloud platforms, and application design patterns.
• Working proficiency on Windows, Linux, and macOS, with container technologies and AWS, Azure, and GCP.
• Willingness to work onsite in Palo Alto, CA to collaborate with product engineering, support complex engagements, and join strategic initiatives.
• Excellent written and verbal communication, able to explain complex technical ideas to executives, product teams, and varied clients.
• Strategic thinking to tie technical work to business goals, with experience shaping product roadmaps or organizational strategy.
• Experience mentoring and guiding other technical people.
• Even Better With: experience working alongside AI/ML models, automated offensive security frameworks, or building AI-augmented attack tools.
• Even Better With: published research, conference speaking, or significant open-source work in offensive security.
• Even Better With: startup or high-growth experience, comfort wearing many hats, and driving work with little bureaucracy.
• Even Better With: advanced certifications such as OSCP, OSCE, CRTE, CRTO, or equivalent elite credentials.
• Even Better With: a record of building offensive security tools or frameworks that the community has adopted.

Conditions

Onsite in Palo Alto, CA.

Benefits

• Full health, dental, and vision coverage.
• Meaningful equity ownership.
• Meals provided in the office.
• Haircuts at the office.
• Company-sponsored conferences and events.
• 401(k), HSA, and FSA plans.
• Flexible PTO.