Red Team Operator (Remote, 12-month Contract)

About the role

We are seeking a Red Team Operator to join our remote team on a 12‑month contract, with the possibility of extension. The role is ideal for a mid‑career offensive security professional with 3‑5 years of experience in red teaming, penetration testing, or related fields.

Key responsibilities

• Plan and execute authorized red team operations and adversary emulation scenarios.
• Research threat actors, campaigns, malware, tooling, infrastructure, and emerging attack techniques.
• Conduct reconnaissance, initial access, privilege escalation, credential access, lateral movement, persistence, command‑and‑control, defense evasion, and data‑access simulations.
• Develop attack paths across Windows, Linux, Active Directory, cloud platforms, identity providers, applications, network infrastructure, and security controls.
• Deploy, operate, monitor, and maintain red team infrastructure.
• Manage command‑and‑control servers, redirectors, payload‑hosting systems, phishing infrastructure, domains, DNS records, TLS certificates, cloud resources, VPNs, and proxies.
• Develop, modify, and troubleshoot payloads, scripts, implants, loaders, tooling, and automation.
• Analyze logs, alerts, and telemetry to determine detection effectiveness.
• Collaborate with threat hunting, detection engineering, incident response, and security operations teams during purple‑team exercises.
• Assess AI‑enabled offensive security pipelines for exploitable weaknesses.
• Document attack paths, timelines, infrastructure configurations, indicators, evidence, control failures, and detection opportunities.
• Produce technical reports and executive summaries for technical teams, security leadership, and system owners.
• Follow authorization requirements, rules of engagement, data‑handling procedures, communication plans, and emergency‑stop conditions.

Required profile

• 3‑5 years of professional experience in red teaming, penetration testing, or offensive security.
• Proven ability to simulate realistic cyber‑attacks across diverse environments.
• Experience with Windows, Linux, Active Directory, and cloud environments.
• Familiarity with command‑and‑control infrastructure, phishing, DNS, TLS, VPN, and proxy technologies.
• Strong analytical, reporting, and collaboration skills.
• Ability to work independently in a fully remote setting.
• Knowledge of AI‑enabled security tools is a plus.

Required skills

• Windows
• Linux
• Active Directory
• Cloud platforms
• VPN
• Proxy
• DNS
• TLS certificates
• Command‑and‑control servers
• Payload development
• Scripting
• Automation