Red Team Operator

LT Harper Group; Greater London; Hybrid; GBP 90,000 - 120,000; Full time

Job summary

LT Harper Group is seeking an experienced red team operator to scope engagements with clients, build infrastructure, and deliver findings. You will run adversary simulations end-to-end and guide clients through outcomes with strong communication and OPSEC discipline.

The role involves working remotely in the UK with optional London office access, and a clear path for internal progression within the team.

Qualifications

• Hands-on red team or assumed breach experience in real client environments.
• Strong Active Directory tradecraft with listed tools.
• Experience with commercial, open-source or in-house C2 frameworks.
• Ability to read code and write or modify tooling.
• Sound OPSEC judgement including detection risk and logging.
• Clear communication with engagement leads and client stakeholders.

Responsibilities

• Scope red team engagements, objectives with clients, and realistic testing goals.
• Build and manage C2 and phishing infrastructure for operations.
• Develop custom tooling and refine TTPs when off-the-shelf tools are too noisy.
• Work across Active Directory, cloud, identity and endpoint control layers.
• Document operations and timelines, deliver reports and lead client debriefs.
• Share tradecraft with junior colleagues and review their approach.

Skills

Red team / offensive security

Active Directory tradecraft

C2 frameworks

Code reading / tooling

OPSEC and attack planning

Client communication

Tools

BloodHound

Rubeus

Certipy

Impacket

NetExec

GoPhish

Evilginx

Job description

You’ll run adversary simulation end to end: scoping objectives with clients, building the infrastructure, writing the tooling and walking the client through what you found. It’s a red team role inside a managed IT and Cyber Security provider whose offensive team works directly alongside the platform it tests.

• Location: Remote (UK), with optional office access in central London
• Level: Experienced operator, with a clear route to progress internally

What you’ll do

• Scope red team, threat simulation and assumed breach engagements, and agree realistic objectives with clients
• Build and manage C2 and phishing infrastructure for operations
• Develop custom tooling and refine TTPs where off-the-shelf tools are too noisy
• Work across Active Directory, cloud, identity and endpoint control layers
• Document operations and timelines, deliver reports and lead client debriefs
• Share tradecraft with more junior colleagues and review their approach

What you’ll need

• Hands-on red team or assumed breach experience in real client environments
• Strong Active Directory tradecraft (BloodHound, Rubeus, Certipy, Impacket, NetExec or similar)
• Experience with commercial, open-source or in-house C2 frameworks
• Ability to read code and write or modify tooling
• Sound OPSEC judgement: detection risk, payload exposure, logging and attack path selection
• Clear communication with engagement leads and client stakeholders

Nice to have:

• Cloud and identity attack paths across Entra ID, Azure, AWS or Google Cloud
• Phishing and initial access experience (GoPhish, Evilginx)
• Defence evasion, payload or malware development
• Independent research or advanced red team training
• Any certs (CRTO / CRTP / OSCE)