Red Team Operator (Colombia)

About the role

The Red Team Operator will design and execute authorized adversary simulations to evaluate the organization’s ability to prevent, detect, investigate, and respond to real‑world cyber threats. This mid‑career offensive security position requires 3–5 years of hands‑on red‑team, penetration‑testing, or adversary‑emulation experience and a strong focus on both attack execution and the supporting infrastructure.

Key responsibilities

• Plan and run red‑team engagements that emulate real‑world TTPs across the full attack lifecycle (recon, initial access, privilege escalation, lateral movement, persistence, C2, defense evasion).
• Deploy, manage, and securely teardown red‑team infrastructure such as C2 servers, redirectors, domains/DNS/TLS, VPNs/proxies, and cloud resources.
• Develop and adapt payloads, implants, and tools to bypass EDR, AV, network, email, and identity controls.
• Build and operate AI‑enabled offensive‑security pipelines to accelerate reconnaissance, tooling, attack‑path analysis, and reporting.
• Analyze telemetry to identify detection gaps and collaborate with threat‑hunting, detection‑engineering, and incident‑response teams (purple‑team activities).
• Document findings, produce technical and executive reports, and mentor junior operators.

Required profile

• 3–5 years of experience in red‑team operations, penetration testing, or adversary emulation.
• Degree in Computer Science, Cybersecurity, or equivalent practical experience.
• Relevant certifications (e.g., OSCP, CRTO, OSEP, OSWE, GPEN) are a plus but not mandatory.
• Strong communication skills to convey technical results to both technical and leadership audiences.

Required skills

• Deep knowledge of Windows, Linux, Active Directory, networking, and authentication systems.
• Experience with cloud platforms (AWS, Azure, GCP) and identity/SSO/MFA solutions.
• Hands‑on experience with C2 frameworks and infrastructure‑as‑code tools.
• Scripting/programming proficiency in Python, PowerShell, Bash, Go, C#, C/C++, or JavaScript.
• Familiarity with EDR, SIEM, and telemetry analysis.
• Understanding of AI‑assisted security workflows (optional).