Red Team Operator

You’ll run adversary simulation end to end: scoping objectives with clients, building the infrastructure, writing the tooling and walking the client through what you found. It’s a red team role inside a managed IT and Cyber Security provider whose offensive team works directly alongside the platform it tests.

• Location: Remote (UK), with optional office access in central London
• Level: Experienced operator, with a clear route to progress internally

What you’ll do

• Scope red team, threat simulation and assumed breach engagements, and agree realistic objectives with clients
• Build and manage C2 and phishing infrastructure for operations
• Develop custom tooling and refine TTPs where off-the-shelf tools are too noisy
• Work across Active Directory, cloud, identity and endpoint control layers
• Document operations and timelines, deliver reports and lead client debriefs
• Share tradecraft with more junior colleagues and review their approach

What you’ll need

• Hands-on red team or assumed breach experience in real client environments
• Strong Active Directory tradecraft (BloodHound, Rubeus, Certipy, Impacket, NetExec or similar)
• Experience with commercial, open-source or in-house C2 frameworks
• Ability to read code and write or modify tooling
• Sound OPSEC judgement: detection risk, payload exposure, logging and attack path selection
• Clear communication with engagement leads and client stakeholders

Nice to have:

• Cloud and identity attack paths across Entra ID, Azure, AWS or Google Cloud
• Phishing and initial access experience (GoPhish, Evilginx)
• Defence evasion, payload or malware development
• Independent research or advanced red team training
• Any certs (CRTO / CRTP / OSCE)

Report this job