Red Team Security Engineer

GENERAL DESCRIPTION

Red Team capability is a core requirement for this position. Equally important is the ability to build and?maintain?automation across SIEM, SOAR, security tooling, APIs, and analyst workflows. The engineer will also?participate?in security analyst activities as operational needs require, including alert investigation, incident response, threat hunting, detection engineering, and security platform support.

The ideal candidate is comfortable moving between offensive and defensive security: conducting an adversary simulation one day, developing automated investigation or response workflows the next, and supporting an active security investigation when needed.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Plan and execute authorized Red Team engagements that simulate realistic?threat?actors and attack paths.
• Conduct reconnaissance, exploitation, privilege escalation, lateral movement, persistence, and other adversary techniques within approved rules of engagement.
• Assess security controls across endpoints, identity platforms, networks, applications, cloud environments, and security infrastructure.
• Perform attack-path analysis and?identify?opportunities where multiple weaknesses can be combined to create material business risk.
• Develop and?maintain?offensive security tools, scripts, payloads, and testing infrastructure.
• Apply the MITRE ATT&CK framework to Red Team planning, execution, reporting, and detection validation.
• Test the organization’s ability to prevent, detect, investigate, and respond to adversary activity.
• Partner with Blue Team/Security Operations personnel to conduct purple-team exercises and improve defensive capabilities.
• Clearly document attack paths, evidence, business impact, control gaps, and recommended remediation.
• Design, develop,?maintain, and improve SIEM and SOAR automation supporting investigation, enrichment, containment, response, and case management.
• Build integrations between security platforms using APIs, webhooks, scripts, and other automation technologies.
• Develop automated enrichment workflows incorporating endpoint, identity, network, cloud, threat intelligence, vulnerability, and asset information.
• Automate common analyst activities such as indicator enrichment, alert triage, evidence collection, account investigation, endpoint investigation, case creation, notification, and response actions.
• Develop reusable scripts and tools using technologies such as Python, PowerShell, REST APIs, JSON, and Git-based development workflows.
• Implement?appropriate testing, logging, error handling, documentation, access controls, and change management for security automation.
• Measure automation effectiveness, including analyst time saved, investigation time, response time, false-positive reduction, and workflow reliability.
• Continuously?identify?opportunities to reduce analyst workload while improving security coverage and response consistency.
• Translate Red Team activity and emerging adversary techniques into actionable detection opportunities.
• Perform detection validation and?identify?gaps between expected and actual security telemetry.
• Improve alert quality through tuning, enrichment, correlation, suppression, and automation.
• Conduct threat hunting based on adversary behaviors, threat intelligence, Red Team findings, and?observed?environmental risks.
• Investigate security alerts and suspicious activity across?endpoint, identity, network, email, cloud, and application environments.
• Perform alert triage, evidence collection, scoping, escalation, containment, and remediation activities.
• Support incident response investigations and coordinate technical response actions.
• Analyze endpoint, authentication, network, cloud, and other security telemetry.
• Investigate suspicious users, systems, processes, files, domains, IP addresses, and other indicators.
• Document investigations and?maintain?appropriate case?records.