Senior Red Team Operator

We are seeking an experienced Senior Red Team Operator to lead advanced offensive security assessments, adversary simulations, and automated security validation across cloud, enterprise infrastructure, Linux/Windows environments, and web applications.
The ideal candidate combines strong hands-on exploitation skills, offensive security automation, and the ability to independently manage end-to-end red team engagements.

Key Responsibilities:

1. Red Team Operations & Adversary Simulation
    • Plan and execute realistic end-to-end red team engagements.
    • Simulate advanced attack scenarios, including initial access, privilege escalation, lateral movement, and post-exploitation.
    • Develop attack scenarios aligned with MITRE ATT&CK.
    • Conduct red and purple team exercises to evaluate detection and response capabilities.
2. Cloud & Infrastructure Security
    • Perform offensive security assessments against private cloud and virtualized infrastructure.
    • Evaluate infrastructure management interfaces, network segmentation, access controls, and workload isolation.
    • Identify infrastructure misconfigurations, vulnerabilities, and potential attack paths.
    • Assess containerized and cloud-native environments.
3. Linux & Windows Security
    • Conduct advanced security assessments of Linux and Windows environments.
    • Evaluate authentication, identity management, privileged access, and operating system hardening.
    • Perform privilege escalation, credential security assessments, and lateral movement simulations.
    • Identify and demonstrate realistic infrastructure attack chains.
4. Web Application & API Security
    • Conduct advanced web application and API penetration testing.
    • Identify and exploit vulnerabilities based on OWASP Top 10 and OWASP API Security Top 10.
    • Assess authentication, authorization, session management, access controls, and business logic vulnerabilities.
    • Evaluate common and advanced attack scenarios, including injection, SSRF, XSS, insecure deserialization, and API abuse.
    • Perform security assessments of internet-facing and internal applications.
    • Develop realistic attack chains connecting web application vulnerabilities to infrastructure compromise.
5. Automated Red Teaming & Security Validation
    • Design and implement automated adversary simulation workflows.
    • Develop reusable attack scenarios, scripts, and testing frameworks.
    • Implement continuous and repeatable security validation processes.
    • Integrate offensive security testing into infrastructure and deployment workflows.
    • Evaluate security control effectiveness and detection coverage.
6. Red Team Reporting & Collaboration
    • Manage the complete red team lifecycle, including planning, execution, reporting, and retesting.
    • Establish engagement methodologies, rules of engagement, and operational safety requirements.
    • Produce detailed technical reports, attack path documentation, and remediation recommendations.
    • Prepare executive summaries and communicate security risks to management.
    • Collaborate with different teams to improve security posture.

Required Qualifications
    • 5+ years of hands-on experience in penetration testing, offensive security, or red teaming.
    • Strong practical experience in web application and API penetration testing.
    • Advanced knowledge of Linux, Windows, enterprise networking, and infrastructure security.
    • Experience assessing private cloud and virtualized environments.
    • Strong understanding of OWASP Top 10, OWASP API Security Top 10, and MITRE ATT&CK.
    • Practical experience in adversary simulation, privilege escalation, lateral movement, and post-exploitation.
    • Strong scripting skills using Python, PowerShell, Bash, or equivalent languages.
    • Experience with security testing automation and offensive security frameworks.
    • Ability to independently lead engagements and deliver professional technical and executive reports.

Preferred Qualifications
    • Hands-on experience with adversary emulation and BAS tools such as MITRE Caldera, Atomic Red Team, Infection Monkey, Prelude Operator, or equivalent platforms.
    • Experience with web application security tools such as Burp Suite, OWASP ZAP, Nuclei, and similar frameworks.
    • Familiarity with offensive security tools such as Metasploit, Impacket, BloodHound, and equivalent solutions.
    • Experience developing custom attack scripts, automated security assessments, and reusable adversary simulation modules.
    • Experience with advanced web exploitation, API security testing, and business logic vulnerability research.
    • Knowledge of container security, cloud-native architectures, and modern application security.
    • Experience with purple teaming, threat-informed defense, and detection validation.
    • Experience mentoring security engineers and developing offensive security methodologies.

Expected Outcomes
    • Establish and continuously improve the organization's red team capabilities.
    • Develop realistic attack scenarios covering infrastructure, cloud, Linux, Windows, web applications, and APIs.
    • Implement automated and repeatable adversary simulation processes.
    • Identify critical attack paths and provide actionable remediation recommendations.
    • Improve security detection, response capabilities, and overall security maturity.