Senior Red Team Operator

We are seeking an experienced Senior Red Team Operator to lead advanced offensive security assessments, adversary simulations, and automated security validation across cloud, enterprise infrastructure, Linux/Windows environments, and web applications. The ideal candidate combines strong hands-on exploitation skills, offensive security automation, and the ability to independently manage end-to-end red team engagements.

Key Responsibilities:

1. Red Team Operations & Adversary Simulation
• Plan and execute realistic end-to-end red team engagements.
• Simulate advanced attack scenarios, including initial access, privilege escalation, lateral movement, and post-exploitation.
• Develop attack scenarios aligned with MITRE ATT&CK.
• Conduct red and purple team exercises to evaluate detection and response capabilities.

2. Cloud & Infrastructure Security
• Perform offensive security assessments against private cloud and virtualized infrastructure.
• Evaluate infrastructure management interfaces, network segmentation, access controls, and workload isolation.
• Identify infrastructure misconfigurations, vulnerabilities, and potential attack paths.
• Assess containerized and cloud-native environments.

3. Linux & Windows Security
• Conduct advanced security assessments of Linux and Windows environments.
• Evaluate authentication, identity management, privileged access, and operating system hardening.
• Perform privilege escalation, credential security assessments, and lateral movement simulations.
• Identify and demonstrate realistic infrastructure attack chains.

4. Web Application & API Security
• Conduct advanced web application and API penetration testing.
• Identify and exploit vulnerabilities based on OWASP Top 10 and OWASP API Security Top 10.
• Assess authentication, authorization, session management, access controls, and business logic vulnerabilities.
• Evaluate common and advanced attack scenarios, including injection, SSRF, XSS, insecure deserialization, and API abuse.
• Perform security assessments of internet-facing and internal applications.
• Develop realistic attack chains connecting web application vulnerabilities to infrastructure compromise.

5. Automated Red Teaming & Security Validation
• Design and implement automated adversary simulation workflows.
• Develop reusable attack scenarios, scripts, and testing frameworks.
• Implement continuous and repeatable security validation processes.
• Integrate offensive security testing into infrastructure and deployment workflows.
• Evaluate security control effectiveness and detection coverage.

6. Red Team Reporting & Collaboration
• Manage the complete red team lifecycle, including planning, execution, reporting, and retesting.
• Establish engagement methodologies, rules of engagement, and operational safety requirements.
• Produce detailed technical reports, attack path documentation, and remediation recommendations.
• Prepare executive summaries and communicate security risks to management.
• Collaborate with different teams to improve security posture.

Required Qualifications
• 5+ years of hands-on experience in penetration testing, offensive security, or red teaming.
• Strong practical experience in web application and API penetration testing.
• Advanced knowledge of Linux, Windows, enterprise networking, and infrastructure security.
• Experience assessing private cloud and virtualized environments.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, and MITRE ATT&CK.
• Practical experience in adversary simulation, privilege escalation, lateral movement, and post-exploitation.
• Strong scripting skills using Python, PowerShell, Bash, or equivalent languages.
• Experience with security testing automation and offensive security frameworks.
• Ability to independently lead engagements and deliver professional technical and executive reports.

Preferred Qualifications
• Hands-on experience with adversary emulation and BAS tools such as MITRE Caldera, Atomic Red Team, Infection Monkey, Prelude Operator, or equivalent platforms.
• Experience with web application security tools such as Burp Suite, OWASP ZAP, Nuclei, and similar frameworks.
• Familiarity with offensive security tools such as Metasploit, Impacket, BloodHound, and equivalent solutions.
• Experience developing custom attack scripts, automated security assessments, and reusable adversary simulation modules.
• Experience with advanced web exploitation, API security testing, and business logic vulnerability research.
• Knowledge of container security, cloud-native architectures, and modern application security.
• Experience with purple teaming, threat-informed defense, and detection validation.
• Experience mentoring security engineers and developing offensive security methodologies.

Expected Outcomes
• Establish and continuously improve the organization's red team capabilities.
• Develop realistic attack scenarios covering infrastructure, cloud, Linux, Windows, web applications, and APIs.
• Implement automated and repeatable adversary simulation processes.
• Identify critical attack paths and provide actionable remediation recommendations.
• Improve security detection, response capabilities, and overall security maturity.