Red Team

Red Team Engineer Jobs

5 jobs found

Today

Security Engineer III, Red Team Operator

Deloitte Baltimore, MD

Baltimore, MD

Today

$111k - $218k/yr Full time Adversary Emulation C2 Framework Cloud Platforms

Apply Now

Job Description

Deloitte seeks a Security Engineer III to operate as a Red Team Operator, executing controlled adversary emulation to evaluate and strengthen detection, response, and resilience across enterprise technology environments.

Role Overview

The Security Engineer III, Red Team Operator will simulate real-world adversary tactics using authorized testing activities. Work may include penetration testing, social engineering, post-exploitation simulations, and structured assessments designed to expose gaps in security controls and improve overall defensive posture.

Key Responsibilities

Plan and execute red team operations targeting enterprise environments, web applications, cloud platforms, and endpoints.
Emulate advanced threat actors using realistic attack paths, tools, and techniques.
Conduct simulations across the attack lifecycle, including reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration.
Evaluate the effectiveness of security controls, monitoring capabilities, and incident response processes.
Run authorized phishing, social engineering, and credential attack exercises.
Develop custom payloads, scripts, and attack workflows to support engagement goals.
Document findings, attack chains, defense gaps, and remediation recommendations.
Produce clear after-action reports and debriefs for technical teams and leadership stakeholders.
Collaborate with blue teams, detection engineers, and security leadership to improve defensive capabilities.
Follow strict rules of engagement, legal requirements, and operational safety practices.

Required Qualifications

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
Active Top-Secret Clearance.
Ability to work onsite up to 5 days a week.
Knowledge of network architecture, protocols, and techniques (for example, tunneling).
Hands-on offensive security experience in red teaming, purple teaming, or adversary simulation.
Strong understanding of enterprise attack techniques across Windows, Active Directory, Linux, cloud, and identity environments.
Experience using command and control frameworks, privilege escalation, lateral movement, and evasion techniques.
Proficiency with tools including Cobalt Strike, Mythic, Metasploit, BloodHound, Burp Suite, Nmap, and PowerShell or Python.
Experience with MITRE ATT&CK mapping and threat emulation.
Ability to write high-quality reports connecting technical findings to business risk.
Certified Red Team Operator (CRTO) or Offensive Security Certified Professional (OSCP).
Ability to travel 20% on average based on client needs and industries served.
Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Technologies and Tools

Cobalt Strike, Mythic, Metasploit, BloodHound, Burp Suite, Nmap
PowerShell, Python
MITRE ATT&CK
Active Directory, Linux, Windows
Cobalt Strike (C2 Framework), Havoc, Sliver
AWS, Azure, GCP

Team Context

Deloitte’s Cyber Defense & Resilience offering helps clients defend against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence. The team supports managing and protecting dynamic attack surfaces and provides rapid crisis and cyber incident response so clients can be ready for, respond to, and recover from business disruptions.

Preferred Qualifications

Experience with C2 frameworks such as Cobalt Strike, Havoc, Mythic, or Sliver.
Experience with cloud red teaming in AWS, Azure, or GCP.
Familiarity with detection engineering, SIEM, EDR, and purple team exercises.
Experience developing custom tooling or modifying public offensive tools.
Knowledge of malware analysis, reverse engineering, or exploit development.

Location and Compensation

Baltimore, MD (onsite)

Salary range: USD 110,700 - 218,300 per year.
A reasonable estimate of the current range is $110,700-$218,300.
At Deloitte, hiring at or near the top of the range is not typical, and compensation decisions depend on the facts and circumstances of each case.

View full job page →

Today

Security Engineer III, Red Team Operator

Deloitte Arlington, VA

Arlington, VA

Today

$111k - $218k/yr Full time Cloud Platforms Cybersecurity Tools Data Security

Apply Now

Job Description

Deloitte Cyber is seeking a Security Engineer III and Red Team Operator to help test real-world security posture through authorized adversary simulations. In this role, you plan and run engagements that mirror how threats operate, translating findings into improvements for detection, response, and overall resilience.

This onsite position is based in Arlington, VA and supports work across enterprise environments, web applications, cloud platforms, and endpoints. The annual salary range for this role is USD 110,700 to 218,300.

What you’ll do

Plan and execute red team operations targeting enterprise environments, web applications, cloud platforms, and endpoints.
Emulate advanced threat actors using realistic attack paths, tools, and techniques.
Run simulations across the full attack lifecycle, including reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration.
Evaluate the effectiveness of security controls, monitoring, and incident response processes.
Perform authorized phishing, social engineering, and credential attack exercises.
Develop custom payloads, scripts, and attack workflows to support engagements.
Document results, attack chains, gaps in defenses, and remediation recommendations.
Produce clear after-action reports and debriefs for technical and leadership stakeholders.
Collaborate with blue teams, detection engineers, and security leadership to improve defensive capabilities.
Follow strict rules of engagement, legal requirements, and operational safety standards.

Required qualifications

2+ years of experience in adversary simulation and offensive security, including red teaming, purple teaming, or adversary emulation.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field.
Active Top-Secret Clearance.
Ability to work onsite up to 5 days per week.
Knowledge of network architecture, protocols, and techniques (for example, tunneling).
Strong understanding of enterprise attack techniques across Windows, Active Directory, Linux, cloud, and identity environments.
Experience with command and control frameworks, privilege escalation, lateral movement, and evasion techniques.
Proficiency with tools such as Cobalt Strike, Mythic, Metasploit, BloodHound, Burp Suite, Nmap, and PowerShell or Python.
Experience with MITRE ATT&CK mapping and threat emulation.
Ability to write high-quality reports connecting technical findings to business risk.
CRTO (Certified Red Team Operator) or OSCP (Offensive Security Certified Professional).
Ability to travel 20% on average based on client and industry needs.
Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Technologies

Cobalt Strike
Mythic
Metasploit
BloodHound
Burp Suite
Nmap
PowerShell
Python
MITRE ATT&CK (including mapping)
Active Directory

Preferred qualifications

Experience with C2 frameworks such as Havoc, Sliver (in addition to Cobalt Strike, Mythic).
Cloud red teaming experience in AWS, Azure, or GCP.
Familiarity with detection engineering, SIEM, EDR, and purple team exercises.
Experience developing custom tooling or modifying public offensive tools.
Knowledge of malware analysis, reverse engineering, or exploit development.

View full job page →

7d ago

Senior Security Engineer & Workday

Hudson Manpower Harrisburg, PA

Harrisburg, PA

7d ago

Full time Senior Cloud Platforms Cybersecurity Tools

Apply Now

Job Description

Join a mission driven security team safeguarding critical infrastructure. This onsite Senior Security Engineer role in Harrisburg, PA centers on red team offensive security, leading red and purple team exercises, building attack infrastructure, and delivering risk based findings across hybrid environments. You will guide offensive engagements, help improve detection with intelligence driven purple team testing, and collaborate with cyber defense, technology, and business stakeholders to elevate resilience. In this position you will become a key member of a team of highly skilled cybersecurity professionals responsible for protecting national critical infrastructure. You will contribute to Red and Purple Team activities, participate in internal presentations and conferences, and share knowledge to strengthen remediation across the organization.

Responsibilities

Execute red team cyber exercises across internal and internet facing systems to uncover misconfigurations and vulnerabilities adversaries could exploit to gain access to data and systems.
Participate in purple team activities to help blue teams enhance their detections and response capabilities.
Lead red team operations against hybrid environments using threat intelligence and the MITRE ATT&CK framework.
Engage in intelligence driven purple team tests to validate detections and tooling.
Build and maintain red and purple team infrastructure, pursuing automation where possible.
Continuously research offensive security tactics and share findings with the team to elevate collective skills.
Conduct ad hoc offensive security testing using industry standard tools or internally developed tools.
Lead the creation of reports featuring compromise narratives, detailed technical findings, risk severity ratings, and practical remediation recommendations, including peer review of deliverables.
Assist cyber defense teams during incident investigations with attacker tradecraft and mindset expertise.
Collaborate with information security, technology, and business stakeholders to raise security awareness and drive remediation efforts.
Actively contribute to Red and Purple Team activities for internal presentations and conferences.

Requirements

Experience with industry standard Red Team tools (Cobalt Strike, Mythic C2, Rubeus, Bloodhound, Covenant, etc.) or demonstrated equivalent knowledge.
Expert understanding of how an advanced persistent threat could compromise a financial institution without phishing.
Extensive knowledge of Red Team concepts, tools, and automation strategies.
Strong grasp of the MITRE ATT&CK framework tactics, techniques, and procedures.
Expert ability to measure and rate vulnerabilities based on core characteristics.
Deep understanding of Windows and Linux system hardening concepts and techniques.
Proficiency in modifying payloads to bypass detections like EDR.
Expert knowledge of compromising environments without using phishing.
Strong scripting capabilities in at least one language (Python, Ruby, PowerShell, Bash, etc.).
Experience with at least one cloud environment (AWS, GCP, Azure).
Proven track record of attacking cloud, on premise, and/or hybrid environments from initial access through objective completion.
Experience delivering Red Team projects including creation and execution of statements of work, risk mitigation strategies, and remediation with stakeholders.
Experience using multi operating system command and control tools.
Experience developing custom attack tradecraft or modifying existing tools.
Experience using automated configuration management such as Chef.
Experience discovering and exploiting vulnerabilities in AI systems.
Experience conducting Offensive Security or Red Team exercises against macOS, iOS, or ChromeOS.
Recognized industry certifications such as GPEN, GXPN, GREM, eCPTX, eCPPT, OSCP, OSWE, CISSP, CPSA, CRT, etc.
Knowledge of industry security standards such as TIBER EU, CBEST, NIST Cyber Security Framework, ISO 27002, etc.
Knowledge of Agile project management.

Technologies

Cobalt Strike
Mythic C2
Rubeus
Bloodhound
Covenant
MITRE ATT&CK
Windows
Linux
Python
Ruby
PowerShell
Bash
AWS
GCP
Azure
Chef
macOS
iOS
ChromeOS

View full job page →

7d ago

Senior Security Engineer, Offensive Security

Datadog New York, NY

New York, NY

7d ago

$195k - $240k/yr Full time Senior Cloud Platforms Detection Engineering

Apply Now

Job Description

Datadog is seeking a Senior Security Engineer with a focus on Offensive Security for a hybrid role based in New York, NY. The position offers an annual salary range of USD 195,000 to 240,000 and centers on planning, executing, and automating red team exercises while developing AI-first offensive tooling for cloud native environments.

Responsibilities

Plan and run red team engagements from inception to completion, simulating real threat actors across cloud infrastructure (AWS, GCP), Kubernetes, CI/CD pipelines, and corporate networks.
Create and maintain custom offensive tooling, automation frameworks, and engagement infrastructure, treating offensive operations as software development work.
Develop tailored payloads and evasion techniques aligned with Datadog's environment and current defensive controls (EDR, SIEM, network monitoring).
Increase operational efficiency through automation and AI, accelerating reconnaissance, vulnerability analysis, and reporting workflows.
Collaborate with the Detection & Response team on purple team exercises to validate detections, improve alert fidelity, and influence threat models.
Translate offensive findings into concrete improvements by working directly with defensive security and engineering teams to close gaps.

Requirements

At least 5 years of hands-on offensive security experience, including red teaming, penetration testing, or adversary simulation, with a track record against mature, well-defended environments.
Proficiency in producing production-quality code (Python, Go, or similar), with the ability to build tools and automate workflows rather than relying solely on off-the-shelf frameworks.
Deep expertise in at least two of the following areas: macOS security, Linux security, cloud platforms (AWS, GCP, Azure), Kubernetes, or CI/CD pipelines.
Experience developing evasion techniques against modern defenses and a solid understanding of detections from the blue team perspective.
Strong communication skills capable of conveying complex offensive findings to both technical and non-technical stakeholders.
Comfort operating in ambiguity, scoping work independently, prioritizing what matters, and driving projects from prototype to deployed and validated solutions.

Technologies

AWS
GCP
Azure
Kubernetes
CI/CD pipelines
Python
Go
EDR
SIEM

Benefits

New hire stock equity (RSUs) and employee stock purchase plan (ESPP)
Continuous professional development, product training, and career pathing
Interdepartmental mentor and buddy program for in-house networking
Inclusive culture with access to Datadog Community Guilds (employee resource groups)
Free global mental health benefits for employees and dependents aged 6 and up
Competitive global benefits

View full job page →

1mo ago

Principal InfoSec Engineer Application Security

Philip Morris International U.S. Tampa, FL

Tampa, FL

1mo ago Closed

$160k - $200k/yr Full time Application Security Cybersecurity Tools Data Security

This position is no longer accepting applications (closed Aug 2, 2026).

Job Description

Philip Morris International U.S. is seeking a Principal InfoSec Engineer focused on Application Security to lead security assurance for PMI U.S. applications from Tampa. This role centers on identifying cybersecurity gaps, owning security engagements for critical projects, and guiding global AppSec strategies that align with PMI U.S. objectives.

Responsibilities

Identify cybersecurity gaps in new and existing applications and systems used by the PMI U.S. business unit via methods including threat modeling, architecture reviews, access model reviews, configuration reviews, and SAST/DAST.
Own the execution of security assurance for the most critical or complex projects in the PMI U.S. business unit, planning and delivering the security engagement from initial risk scoping and design checkpoints to final pre go-live assessments, ensuring security requirements are addressed throughout the project lifecycle.
Develop tailored assurance plans for projects that deviate from standards, determining additional assessment steps when new technologies are adopted and coordinating with other specialized InfoSec teams or external experts.
Describe and demonstrate identified issues through reports and technical debt definitions, ensuring stakeholders understand the risk and advising technology teams on effective and cost-efficient remediation and replication steps.
Coordinate with other AppSec teams to obtain specialized input, bring in Offensive Security specialists for targeted activities, and integrate findings into project advisories while feeding common pain points back into AppSec baselines.
Support the creation of global application security strategies and implement strategic AppSec plans and initiatives for PMI U.S.
Partner with Information Security leaders to continuously optimize tools, techniques, and methodologies across the PMI U.S. AppSec domain.
Stay current with the evolving cyber threat landscape and advances in technology and cyber risk management.

Requirements

10+ years of experience in Information Security, preferably within IT risk or assurance (IT Security, IT Audit, Application Security, or Offensive Security) in a large organization or consulting environment.
Proven track record of autonomously executing complex IT security assessments or IT audits for large-scale technology solutions, including architectural reviews, configuration reviews, and automated testing (SAST, DAST).
Broad familiarity with multiple IT domains such as application development, cloud, and infrastructure.
Technical depth to challenge design decisions when needed and assess whether architectures meet segmentation requirements.
Risk evaluation and articulation skills with the ability to foresee project constraints and pragmatically propose mitigations that balance security with practical delivery.
Excellent communication skills to lead discussions with project managers and architects and brief senior management on residual risks; strong negotiation skills to drive necessary security changes.
Strong report writing abilities for executive summaries and risk registers, plus experience improving team processes and refining methodologies (for example, standardized threat model templates).
Professional security certifications: CISA (mandatory), CISSP (mandatory). CISM is optional but preferred.

Technologies

SAST
DAST

Benefits

Annual bonus
Medical, dental, and vision coverage
401k with a generous company match
Wellness benefits
Commuter benefits
Pet insurance
Generous PTO
Hybrid work model (Smart Work) promoting flexibility
Inclusive, diverse culture
Opportunities to progress and develop skills in a global business
Autonomy to take risks, experiment, and explore
Mission driven work contributing to society

Salary

USD 160,000 - 200,000 per year

Location

Onsite in Tampa, Florida

View full job page →

Red Team Engineer Jobs

Security Engineer III, Red Team Operator

Security Engineer III, Red Team Operator

Senior Security Engineer & Workday

Senior Security Engineer, Offensive Security

Principal InfoSec Engineer Application Security

Get Red Team Engineer Jobs alerts