Purple Team Specialist

Neotalent Conclusion; Madrid; Hybrid; EUR 75,000 - 115,000; Full time

Benefits offered by this job

Hybrid working model in Madrid

Private health insurance

Meal vouchers

Transportation allowance

Training and certifications

Childcare support

Global Security Operations Center role

Job summary

Neotalent Conclusion in Madrid is seeking a Purple Team Specialist to join our cybersecurity team, working with a leading global insurance client in an international environment. You will lead adversary emulation, threat hunting, and detection engineering efforts within MITRE ATT&CK-aligned workflows.

The role requires 3–7 years in security, hands-on Red/ Purple Team experience, and strong skills in KQL, SIEM, and cloud security.

Qualifications

• University degree in Information Security, Computer Science, or Engineering.
• Between 3 and 7 years of professional experience in cybersecurity environments.
• At least 3 years of hands-on experience in offensive security, adversary emulation, detection engineering, threat hunting, incident response, or related disciplines.
• At least 3 years of practical Red Team and/or Purple Team experience in enterprise environments.
• Strong expertise in Detection Engineering (mandatory and key requirement).
• Proven experience transforming test results into improved detections, telemetry, investigation processes, response playbooks, and remediation actions.
• Deep understanding of MITRE ATT&CK and threat-informed defense methodologies.
• Experience with enterprise SOC technologies, including SIEM, EDR/XDR, SOAR, network security monitoring, email security, identity telemetry, and cloud security logging solutions.
• Strong expertise with Microsoft Sentinel.
• Strong expertise with Microsoft Defender XDR.
• Hands-on experience writing and optimizing KQL queries.
• Knowledge of Windows, Linux, Active Directory, Microsoft Entra ID, Microsoft 365, cloud, and network attack paths and post-exploitation techniques.
• Experience developing automation using Python, PowerShell, Bash, APIs, version control systems, and CI/CD environments.
• Excellent English communication skills. Spanish is a plus.

Responsibilities

• Plan and execute threat-led security validation exercises based on threat intelligence, recent incidents, business risks, and detection gaps.
• Design and perform adversary emulation campaigns across endpoint, identity, email, network, and cloud environments.
• Map attack activities to the MITRE ATT&CK framework and assess security control effectiveness.
• Partner with Detection Engineering and Threat Hunting teams to validate telemetry and improve detection coverage.
• Create, tune, and optimize analytics, correlation rules, and behavioral detections.
• Validate and improve KQL queries, reducing blind spots and false negatives.
• Assess end-to-end SOC readiness, including alert generation, enrichment, triage, escalation, investigation, containment, and documentation processes.
• Evaluate technical controls, operational procedures, and automated response playbooks.
• Produce root cause analyses, remediation recommendations, and re-testing activities until objectives are achieved.
• Develop automation assets, reusable testing content, integrations, and reporting mechanisms using Python, PowerShell, Bash, APIs, and CI/CD pipelines.
• Maintain ATT&CK-aligned coverage metrics and reporting on detection performance and remediation progress.
• Facilitate purple team workshops, after-action reviews, and knowledge-sharing sessions with SOC stakeholders.

Skills

MITRE ATT&CK knowledge

Adversary emulation

Red Team experience

Purple Team experience

Detection Engineering

English communication

Network security monitoring

Education

University degree in Information Security, Computer Science, or Engineering

Tools

KQL (Kusto)

Python

PowerShell

Bash

APIs

CI/CD

Microsoft Sentinel

Microsoft Defender XDR

SIEM

EDR/XDR

SOAR

Cloud security logging

Windows

Linux

Active Directory

Entra ID

Microsoft 365

Job description

Neotalent Conclusion is one of the leading Iberian specialists in Information Technology and Engineering Talent acquisition and management. As part of the Dutch Conclusion group, an ecosystem of 25 companies and 3,600 employees, we focus on increasing our clients’ technological capabilities and accelerating their digital transformation.

At Neotalent Conclusion, we are talent specialists. We attract the best professionals and combine them with the most ambitious projects at the right time. Our success is built on investment in innovation, a results-driven mindset, and above all, ensuring that people have fulfilling and rewarding careers.

With more than 25 years of experience, Neotalent Conclusion has offices in Madrid, Lisbon, and Porto. Our company is made up of a team of more than 850 professionals across different areas of operation.

Neotalent, the responsive people.

More information at www.neotalent.pt/en and https://neotalent.pt/en/careers/.

We are looking for a Purple Team Specialist to join our teams and work with a leading global insurance company in an international cybersecurity environment.

What will your responsibilities be?

• Plan and execute threat-led security validation exercises based on threat intelligence, recent incidents, business risks, and detection gaps.
• Design and perform adversary emulation campaigns and atomic testing activities across endpoint, identity, email, network, and cloud environments.
• Map attack activities to the MITRE ATT&CK framework and assess security control effectiveness.
• Partner with Detection Engineering and Threat Hunting teams to validate telemetry and improve detection coverage.
• Create, tune, and optimize analytics, correlation rules, and behavioral detections.
• Validate and improve KQL queries, reducing blind spots and false negatives.
• Assess end-to-end SOC readiness, including alert generation, enrichment, triage, escalation, investigation, containment, and documentation processes.
• Evaluate technical controls, operational procedures, and automated response playbooks.
• Produce root cause analyses, remediation recommendations, and re-testing activities until objectives are achieved.
• Develop automation assets, reusable testing content, integrations, and reporting mechanisms using Python, PowerShell, Bash, APIs, and CI/CD pipelines.
• Maintain ATT&CK-aligned coverage metrics and reporting on detection performance and remediation progress.
• Facilitate purple team workshops, after-action reviews, and knowledge-sharing sessions with SOC stakeholders.

What profile are we looking for?

• University degree in Information Security, Computer Science, Engineering, or an equivalent combination of education and professional experience.
• Between 3 and 7 years of professional experience in cybersecurity environments.
• At least 3 years of hands-on experience in offensive security, adversary emulation, penetration testing, detection engineering, threat hunting, incident response, or related disciplines.
• At least 3 years of practical Red Team and/or Purple Team experience in enterprise environments.
• Strong expertise in Detection Engineering (mandatory and key requirement).
• Proven experience transforming test results into improved detections, telemetry, investigation processes, response playbooks, and remediation actions.
• Deep understanding of MITRE ATT&CK and threat-informed defense methodologies.
• Experience with enterprise SOC technologies, including SIEM, EDR/XDR, SOAR, network security monitoring, email security, identity telemetry, and cloud security logging solutions.
• Strong expertise with Microsoft Sentinel.
• Strong expertise with Microsoft Defender XDR.
• Hands-on experience writing and optimizing Kusto Query Language (KQL) queries.
• Knowledge of Windows, Linux, Active Directory, Microsoft Entra ID, Microsoft 365, cloud, and network attack paths and post-exploitation techniques.
• Experience developing automation using Python, PowerShell, Bash, APIs, version control systems, and CI/CD environments.
• Excellent English communication skills. Spanish is a plus.

Nice to have:

• Experience working in highly regulated or multinational enterprise environments.
• Experience supporting large-scale Security Operations Centers.
• Knowledge of cloud security architectures and modern detection engineering practices.

Required Certifications (mandatory)

Candidates must hold one or more of the following certifications:

• OSCP (Offensive Security Certified Professional)
• CRTO (Certified Red Team Operator)
• CRTP (Certified Red Team Professional)
• GXPN (GIAC Exploit Researcher and Advanced Penetration Tester)
• GCFA (GIAC Certified Forensic Analyst)
• SC-200 (Microsoft Security Operations Analyst)
• AZ-500 (Microsoft Azure Security Engineer Associate)
• Microsoft Sentinel Certifications
• Work as a Neotalent Conclusion employee in an exclusive partnership with our client.
• Hybrid working model based in Madrid.
• International English-speaking environment.
• Access to continuous training and certifications.
• Enjoy a flexible compensation plan (meal vouchers, transportation allowance, training, private health insurance, and childcare support).
• Opportunity to work within a global Security Operations Center delivering services worldwide.
• Participate in advanced Purple Team, Detection Engineering, Threat Hunting, and Adversary Emulation initiatives.