Red Team Operator

ThreatSpike Ltd.; United Kingdom; Remote; GBP 80,000 - 110,000; Full time

Job summary

Threatspike Labs is seeking a Red Team Operator to perform adversary simulations, scope engagements with clients, and set up infrastructure for red team operations. You will create custom tooling, refine TTPs, and oversee deliverables with client debriefs.

A successful candidate will maintain professional development, document operations for reporting, and communicate clearly with clients and internal teams.

Qualifications

• Experience performing red team operations.
• Strong problem-solving and analytical skills.
• Ability to communicate clearly with clients and team.
• Willingness to pursue professional certifications.

Responsibilities

• Perform approved adversary simulations with clients.
• Scope engagements with clients to determine objectives for threat simulation.
• Set up infrastructure for red team operations and create custom tooling.
• Discover and improve TTPs used in engagements.
• Oversee handover of deliverables and client debriefs.
• Document operations and timelines for accurate reporting.

Skills

Problem solving

Programming

Low-level concepts

OPSEC awareness

Communication

Adversary simulation

Job description

Skip to content

Red Team Operator

About the Job

Threatspike Labs as a whole provides many types of penetration testing and red team adversary engagements that clients may choose from. This includes but is not limited to web and API testing, external and internal infrastructure testing, wireless and physical testing, as we as mature red team and assumed breach testing.

A red team operator at Threatspike Labs will be expected to continue taking their professional development seriously.

Roles and Responsibilities

In this role, your primary duties will involve performing approved adversary simulation. This will involve scoping engagements with clients in order to ascertain the best testing objectives to set for threat simulation, red team and assumed breach engagements. Setting up infrastructure for red team related operations, creating custom tooling and discovering and improving TTPs.

Overseeing the hand over of client deliverables, and client facing debriefs will also be expected. Documentation is a key skill to have and will be necessary for recording operations and timelines for optimal reporting.

A perfect candidate would have:

• Motivation, passion and determination. This is what you can not learn from a course.
  Questions you should be asking yourself are:
  
  • How do I stay up to date with emerging adversary tradecraft, tooling and TTPs relevant to red team operations?
• How do I continuously improve my operational security, stealth and tradecraft during engagements? Do I actively seek to understand how real threat actors operate
• How to safely replicate those behaviours in a controlled and professional manner?
• Excellent problem-solving skills: You have a mature research methodology for handling unknown problems during red team operations. When an objective cannot be achieved through standard methods, you can identify alternative routes, adapt your approach, and propose realistic solutions that still align with the agreed rules of engagement.
• Strong understanding of low-level technical concepts: You understand operating systems, networking, authentication protocols, endpoint controls, identity platforms and the OSI model. You can apply tradecraft across these areas, understand how systems react to offensive tooling, and identify where custom tooling, modified techniques or alternative attack paths may be required to overcome operational obstacles.
• Experience with programming and tooling: You can read and understand code, identify security weaknesses, and develop scripts or tooling to support red team objectives. You should be comfortable modifying existing tools, automating repetitive tasks, and creating lightweight capability where off-the-shelf tooling is unsuitable or too exposed.
• Hands-on experience across different operating systems, networks and enterprise technologies: At this level, you should have practical experience in labs, training environments and real client environments. You should understand how enterprise environments are built, monitored and defended, and be able to operate across Windows, Linux, cloud, identity, network and security control layers.
• Strong operational awareness: You understand that red team operations are not only about achieving technical compromise, but doing so in a controlled, realistic and professional manner. You should be able to consider OPSEC, detection risk, logging, payload exposure, infrastructure management, attack path selection and the wider impact of your actions during an engagement.
• Excellent communication skills: As a red team operator, you will be responsible for communicating clearly with the engagement lead, internal team members and client stakeholders where required. You should be able to explain progress, blockers, risks and outcomes professionally, while avoiding confusion that could affect delivery. You should also be able to support colleagues in more junior roles by sharing tradecraft, reviewing their approach and helping them develop safely and effectively.
• At this level, you should be looking towards advanced certifications, specialist training and independent research that align with red team operations. This may include areas such as adversary simulation, Active Directory exploitation, cloud attack paths, defence evasion, exploit development, malware development, social engineering, command and control, and detection engineering.

In this role, you will be expected to use a range of industry-standard, open-source, commercial and in-house tooling to support red team operations. This includes, but is not limited to, the following tools or suitable equivalents:

• External reconnaissance and attack surface mapping: Nmap, Masscan, Amass, Shodan, httpx, Nuclei, Eyewitness and DNS tooling.
• Web application exploitation: Burp Suite, custom scripts, Sqlmap, XSStrike and other tooling used to identify and exploit web application weaknesses where relevant to the operation.
• Phishing and initial access: GoPhish, Evilginx, custom phishing infrastructure, payload delivery mechanisms and supporting infrastructure used in controlled social engineering scenarios.
• Command and control: Commercial, open-source or in-house C2 frameworks used to support controlled post-exploitation activity, subject to the agreed rules of engagement.
• Internal network operations: BloodHound and collectors, Rubeus, Certipy, Snaffler, Responder, Impacket, NetExec, Kerberoasting tooling and other Active Directory tradecraft.
• Cloud and identity testing: Tooling used to assess Microsoft 365, Entra ID, Azure, AWS, Google Cloud and other identity or cloud environments where they form part of the operation.
• Payload development and tooling: Custom scripts, modified tooling and lightweight capability developed to support specific operational objectives where standard tooling is unsuitable.
• ThreatSpike Wire: You will receive training on how to use our in-house platform.

In addition to using the above tooling, you should be able to select techniques and tools based on operational risk, detection likelihood and client objectives. You should understand when it is appropriate to use standard tooling, when to modify existing tooling, and when to use a more OPSEC-conscious methodology to achieve the same outcome safely and professionally.

Learning and Development

Any candidate must have the ability and desire to understand and learn new concepts on their own in addition to the training we will provide. We are committed to helping the selected candidate obtain professional certifications. The goal is not for the candidate to remain a red team operator if accepted for the position, but then to advance internally by upskilling.

Location

This is a remote role and we are hiring in the following countries:

• United Kingdom
• France
• United States
• Singapore